{"record":{"id":"fe81183175eb7f03","repo":"databendlabs/databend","slug":"iceberg-load-table-response-did-not-contain-vended","errorCode":null,"errorMessage":"Iceberg load_table response did not contain vended credentials","messagePattern":"Iceberg load_table response did not contain vended credentials","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/query/storages/iceberg/src/credential.rs","lineNumber":110,"sourceCode":"trait VendedCredentialProvider: Send + Sync {\n    async fn load(&self) -> anyhow::Result<VendedCredential>;\n}\n\nstruct CatalogCredentialProvider {\n    catalog: Arc<dyn iceberg::Catalog>,\n    table_ident: TableIdent,\n}\n\n#[async_trait]\nimpl VendedCredentialProvider for CatalogCredentialProvider {\n    async fn load(&self) -> anyhow::Result<VendedCredential> {\n        let table = self\n            .catalog\n            .load_table(&self.table_ident)\n            .await\n            .map_err(|error| anyhow!(\"failed to refresh Iceberg table credentials: {error:?}\"))?;\n        VendedCredential::from_table(&table).ok_or_else(|| {\n            anyhow!(\"Iceberg load_table response did not contain vended credentials\")\n        })\n    }\n}\n\nstruct RefreshingAwsCredentialLoader {\n    provider: Arc<dyn VendedCredentialProvider>,\n    current: Mutex<VendedCredential>,\n}\n\nimpl RefreshingAwsCredentialLoader {\n    fn new(provider: Arc<dyn VendedCredentialProvider>, current: VendedCredential) -> Self {\n        Self {\n            provider,\n            current: Mutex::new(current),\n        }\n    }\n}\n","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/databendlabs/databend/blob/288d84d76e20a2f8f7173bda9691eb6ece301aa9/src/query/storages/iceberg/src/credential.rs#L92-L128","documentation":"The Iceberg catalog's `load_table` succeeded, but the response did not carry vended storage credentials where `VendedCredential::from_table` expects them (config/properties on the table metadata). The provider returns this error because without vended credentials it cannot hand temporary storage credentials to the I/O layer.","triggerScenarios":"Catalog/server is not configured for credential vending (no `s3.signer` / remote-signing or vended-credential config on the table or catalog), so the load_table response lacks the expected config entries.","commonSituations":"Iceberg REST catalog without vended-credentials/signing enabled, table created by another engine that never stored storage credentials, catalog version too old to support credential vending, mismatch between expected property key and what the catalog returns.","solutions":["Enable credential vending / remote signing on the Iceberg catalog and table (e.g. S3 Signer / vended-credentials support in the REST catalog).","Verify `VendedCredential::from_table`'s expected config keys match what your catalog version actually returns; upgrade the catalog if it predates support.","As a workaround, configure static storage credentials on the Databend connection/catalog config instead of relying on vending.","Check the catalog's load_table response (config section) with curl to see which properties are actually present."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// before relying on vending, check the catalog advertises it:\n// GET {catalog}/v1/config -> look for \"s3.signer\" / vended-credentials capability\nfn catalog_supports_vending(cfg: &serde_json::Value) -> bool {\n    cfg.get(\"signer\").is_some() || cfg.get(\"capabilities\").and_then(|c| c.get(\"vended-credentials\")).is_some()\n}","typeGuard":null,"tryCatchPattern":"match provider.load().await {\n    Err(e) if e.to_string().contains(\"did not contain vended credentials\") =>\n        fallback_to_static_credentials(),\n    other => other,\n}","preventionTips":["Enable credential vending / remote signing on the Iceberg catalog","Pin a catalog version that supports vended credentials","Configure static storage credentials as a documented fallback"],"tags":["iceberg","credentials","catalog"],"backgroundTag":"empty-api-response","analyzedSha":"288d84d76e20a2f8f7173bda9691eb6ece301aa9","analyzedAt":"2026-09-11T11:29:36.208Z","contentChangedAt":"2026-09-11T11:29:36.208Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}