{"record":{"id":"e5c2c1cb13cf844f","repo":"apache/hadoop","slug":"no-cos-credentials-provided-by-s","errorCode":null,"errorMessage":"No COS Credentials provided by %s","messagePattern":"No COS Credentials provided by (.+?)","errorType":"exception","errorClass":"NoAuthWithCOSException","httpStatus":null,"severity":"critical","filePath":"hadoop-cloud-storage-project/hadoop-cos/src/main/java/org/apache/hadoop/fs/cosn/auth/COSCredentialsProviderList.java","lineNumber":112,"sourceCode":"\n    this.checkNotEmpty();\n\n    if (this.reuseLastProvider && this.lastProvider != null) {\n      return this.lastProvider.getCredentials();\n    }\n\n    for (COSCredentialsProvider provider : this.providers) {\n      COSCredentials credentials = provider.getCredentials();\n      if (null != credentials\n           && !StringUtils.isNullOrEmpty(credentials.getCOSAccessKeyId())\n           && !StringUtils.isNullOrEmpty(credentials.getCOSSecretKey())\n           || credentials instanceof AnonymousCOSCredentials) {\n        this.lastProvider = provider;\n        return credentials;\n      }\n    }\n\n    throw new NoAuthWithCOSException(\n        \"No COS Credentials provided by \" + this.providers.toString());\n  }\n\n  @Override\n  public void refresh() {\n    if (this.closed()) {\n      return;\n    }\n\n    for (COSCredentialsProvider cosCredentialsProvider : this.providers) {\n      cosCredentialsProvider.refresh();\n    }\n  }\n\n  @Override\n  public void close() throws Exception {\n    if (this.closed()) {\n      return;","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-cloud-storage-project/hadoop-cos/src/main/java/org/apache/hadoop/fs/cosn/auth/COSCredentialsProviderList.java#L94-L130","documentation":"getCredentials() walks the provider chain and accepts the first provider whose credentials have a non-empty access key AND secret key, or which returns AnonymousCOSCredentials. If every provider yields null or blank/incomplete credentials, it throws NoAuthWithCOSException(\"No COS Credentials provided by \" + providers) — the chain is non-empty (unlike the empty-list error) but no provider could produce usable credentials.","triggerScenarios":"SimpleCosCredentialsProvider configured but fs.cosn.userinfo.secretId/secretKey blank or placeholder; EnvironmentVariableCredentialsProvider with COS_SECRETID/COS_SECRETKEY unset or empty; a temporary-credentials provider whose underlying role/token fetch fails silently and returns null.","commonSituations":"Deploying to nodes without the env vars the provider expects; templates injecting empty secret values; rotating keys and leaving the config half-updated; running outside CVM while relying only on a role-based provider.","solutions":["Inspect the providers list printed in the message to see which chain was actually built, then fix the specific provider's inputs","For SimpleCosCredentialsProvider, verify fs.cosn.userinfo.secretId and fs.cosn.userinfo.secretKey are non-empty and valid","For EnvironmentVariableCredentialsProvider, export COS_SECRETID and COS_SECRETKEY on all nodes","Test credentials independently with the cos_api SDK or coscmd CLI from the same host"],"exampleFix":"# before\n# fs.cosn.userinfo.secretId set, secretKey left empty\n# -> No COS Credentials provided by [SimpleCosCredentialsProvider{...}]\n\n# after\n<property><name>fs.cosn.userinfo.secretId</name><value>AKIDxxxx</value></property>\n<property><name>fs.cosn.userinfo.secretKey</name><value>xxxx</value></property>","handlingStrategy":"validation","validationCode":"// Pre-flight the credential chain resolves non-blank credentials\nString sid = conf.get(\"fs.cosn.userinfo.secretId\");\nString skey = conf.get(\"fs.cosn.userinfo.secretKey\");\nif (isNullOrEmpty(sid) || isNullOrEmpty(skey)) {\n  throw new IllegalStateException(\"cosn secretId/secretKey missing or blank\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  providerList.getCredentials();\n} catch (NoAuthWithCOSException e) {\n  // message lists every provider in the chain — use it to find which one is misconfigured\n  LOG.error(\"Credential chain exhausted: {}\", e.getMessage());\n  throw e;\n}","preventionTips":["Set both secretId and secretKey — a blank half fails the non-empty check","Export COS_SECRETID/COS_SECRETKEY on every node when using the env provider","Smoke-test credentials with coscmd or the raw SDK from the same host"],"tags":["cosn","hadoop-cos","authentication","invalid-credentials","configuration"],"backgroundTag":"no-valid-credentials","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}