{"id":"7dfa0c1c1815942a","repo":"celery/celery","slug":"missing-aws-s3-creds","errorCode":null,"errorMessage":"Missing aws s3 creds","messagePattern":"Missing aws s3 creds","errorType":"exception","errorClass":"ImproperlyConfigured","httpStatus":null,"severity":"error","filePath":"celery/backends/s3.py","lineNumber":86,"sourceCode":"\n    def set(self, key, value):\n        key = bytes_to_str(key)\n        s3_object = self._get_s3_object(key)\n        s3_object.put(Body=value)\n\n    def delete(self, key):\n        key = bytes_to_str(key)\n        s3_object = self._get_s3_object(key)\n        s3_object.delete()\n\n    def _connect_to_s3(self):\n        session = boto3.Session(\n            aws_access_key_id=self.aws_access_key_id,\n            aws_secret_access_key=self.aws_secret_access_key,\n            region_name=self.aws_region\n        )\n        if session.get_credentials() is None:\n            raise ImproperlyConfigured('Missing aws s3 creds')\n        return session.resource('s3', endpoint_url=self.endpoint_url)\n","sourceCodeStart":68,"sourceCodeEnd":88,"githubUrl":"https://github.com/celery/celery/blob/571efe81202341310b6257304980ba7898ab0f60/celery/backends/s3.py#L68-L88","documentation":"After building a boto3.Session with the configured keys, S3Backend._connect_to_s3 calls session.get_credentials(); if that returns None (no credentials resolved from any provider chain) it raises ImproperlyConfigured('Missing aws s3 creds'). This catches the case where neither explicit keys, env vars, shared-credentials file, nor an IAM role yielded credentials.","triggerScenarios":"Configuring the S3 backend with neither s3_access_key_id/s3_secret_access_key in conf nor AWS_* env vars nor an attached IAM role, then instantiating the backend.","commonSituations":"Local development without AWS env vars; ECS/EC2 task role not attached; expired STS session tokens; credentials file missing on the worker host; misspelled s3_access_key_id key.","solutions":["Set app.conf.s3_access_key_id and app.conf.s3_secret_access_key","Or export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the worker environment","Or attach an IAM instance/task role when running on AWS (EC2/ECS/EKS)","Verify with `aws sts get-caller-identity` that credentials resolve on the host"],"exampleFix":"// before\napp.conf.result_backend = 's3'\napp.conf.s3_bucket = 'bucket'\n# no credentials anywhere\n\n// after\napp.conf.result_backend = 's3'\napp.conf.s3_bucket = 'bucket'\napp.conf.s3_access_key_id = os.environ['AWS_ACCESS_KEY_ID']\napp.conf.s3_secret_access_key = os.environ['AWS_SECRET_ACCESS_KEY']","handlingStrategy":"validation","validationCode":"import boto3\nsess = boto3.Session(\n    aws_access_key_id=app.conf.get('s3_access_key_id'),\n    aws_secret_access_key=app.conf.get('s3_secret_access_key'),\n    region_name=app.conf.get('s3_region'),\n)\nif sess.get_credentials() is None:\n    raise SystemExit('No AWS credentials resolved; set s3_access_key_id/s3_secret_access_key or attach an IAM role')","typeGuard":null,"tryCatchPattern":"from celery.exceptions import ImproperlyConfigured\ntry:\n    backend = S3Backend(app=app)\nexcept ImproperlyConfigured as e:\n    if 'creds' in str(e):\n        # fall back, alert, or attach role\n        raise\n    raise","preventionTips":["Prefer IAM roles over static keys on AWS compute","Validate credential resolution at deploy time with aws sts get-caller-identity","Never hardcode keys; use env vars or a secrets manager"],"tags":["s3","aws","credentials","configuration","security"],"analyzedSha":"571efe81202341310b6257304980ba7898ab0f60","analyzedAt":"2026-08-04T20:17:20.567Z","schemaVersion":2}