{"record":{"id":"e96767a983d045dc","repo":"apache/hadoop","slug":"class-classname-aws-provider-class-cannot-be-use","errorCode":null,"errorMessage":"Class {className} AWS provider class cannot be used (configuration key {key})","messagePattern":"Class (.+?) AWS provider class cannot be used \\(configuration key (.+?)\\)","errorType":"exception","errorClass":"InstantiationIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/CredentialProviderListFactory.java","lineNumber":243,"sourceCode":"    // each provider\n    AWSCredentialProviderList providers = new AWSCredentialProviderList();\n    for (String className : awsClasses) {\n      if (v1v2CredentialProviderMap.containsKey(className)) {\n        // mapping\n\n        final String mapped = v1v2CredentialProviderMap.get(className);\n        LOG_REMAPPED_ENTRY.warn(\"Credentials option {} contains AWS v1 SDK entry {}; mapping to {}\",\n            key, className, mapped);\n        className = mapped;\n      } else if (awsCredsMappedClasses != null && awsCredsMappedClasses.containsKey(className)) {\n        final String mapped = awsCredsMappedClasses.get(className);\n        LOG_REMAPPED_ENTRY.debug(\"Credential entry {} is mapped to {}\", className, mapped);\n        className = mapped;\n      }\n      // now scan the forbidden list. doing this after any mappings ensures the v1 names\n      // are also blocked\n      if (forbiddenClassnames.contains(className)) {\n        throw new InstantiationIOException(InstantiationIOException.Kind.Forbidden,\n            binding, className, key, E_FORBIDDEN_AWS_PROVIDER, null);\n      }\n\n      AwsCredentialsProvider provider;\n      try {\n        provider = createAWSV2CredentialProvider(conf, className, binding, key);\n      } catch (InstantiationIOException e) {\n        // failed to create a v2; try to see if it is a v1\n        if (e.getKind() == InstantiationIOException.Kind.IsNotImplementation) {\n          if (isAwsV1SdkAvailable()) {\n            // try to create v1\n            LOG.debug(\"Failed to create {} as v2 credentials, trying to instantiate as v1\",\n                className);\n            try {\n              provider =\n                  AwsV1BindingSupport.createAWSV1CredentialProvider(conf, className, binding, key);\n              LOG_REMAPPED_ENTRY.warn(\"Credentials option {} contains AWS v1 SDK entry {}\",\n                  key, className);","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/CredentialProviderListFactory.java#L225-L261","documentation":"InstantiationIOException raised while building a credential provider chain: after v1-to-v2 class remapping, the requested class is on that chain's forbidden list (Kind.Forbidden, reason E_FORBIDDEN_AWS_PROVIDER). Forbidden lists prevent loops and delegation problems - most notably AssumedRoleCredentialProvider may not appear inside the sub-chains it builds (fs.s3a.assumed.role.credentials.provider forbids itself).","triggerScenarios":"Listing a forbidden class where a sub-chain is built: org.apache.hadoop.fs.s3a.auth.AssumedRoleCredentialProvider inside fs.s3a.assumed.role.credentials.provider (nested assumed roles), or forbidden entries in the session-token binding's chain. The error names the class and the configuration key involved.","commonSituations":"Copying the full fs.s3a.aws.credentials.provider list into fs.s3a.assumed.role.credentials.provider; attempts to chain assumed roles through config; hadoop-aws upgrades where v1 provider names are remapped and forbidden lists changed.","solutions":["Remove AssumedRoleCredentialProvider from the inner list (fs.s3a.assumed.role.credentials.provider) - only base providers (simple, environment, profile, instance profile) may feed STS","Read the error message: it names both the offending class and the configuration key that contained it","For role chaining, use IAM/STS trust policies instead of nesting S3A providers","Make sure classnames are spelled exactly and are AWS SDK v2 providers (v1 names are remapped with a warning)"],"exampleFix":"<!-- before: assumed-role provider nested inside its own inner chain -->\n<property><name>fs.s3a.assumed.role.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.auth.AssumedRoleCredentialProvider,\n         org.apache.hadoop.fs.s3a.SimpleAWSCredentialsProvider</value></property>\n\n<!-- after: only base providers feed STS -->\n<property><name>fs.s3a.assumed.role.credentials.provider</name>\n  <value>org.apache.hadoop.fs.s3a.SimpleAWSCredentialsProvider</value></property>","handlingStrategy":"validation","validationCode":"for (String c : conf.getTrimmedStrings(\"fs.s3a.assumed.role.credentials.provider\")) {\n  if (c.endsWith(\"AssumedRoleCredentialProvider\")) {\n    throw new IOException(\"Forbidden provider in inner chain: \" + c);\n  }\n}","typeGuard":null,"tryCatchPattern":"catch InstantiationIOException at fs initialization; the message names the class and the configuration key - remove the forbidden entry from that property; never retry","preventionTips":["Never copy the top-level provider list into sub-provider properties","Keep provider chains minimal and reviewed","Re-validate credential configuration after hadoop-aws upgrades (v1 names are remapped)"],"tags":["s3a","hadoop-aws","credentials","provider-chain","configuration","assumed-role"],"backgroundTag":"invalid-credential-provider-config","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}