dgraph-io/dgraph · error

cannot create backup handler

Error message

cannot create backup handler

What it means

Wrapped by handleRestoreProposal (worker/online_restore.go:245) after NewUriHandler(uri, creds) fails. NewUriHandler matches the URI scheme to a storage backend handler (s3, minio, gcs, azure, file) and validates credentials; failure means the scheme is unsupported or the supplied credentials/options are invalid for that handler.

Source

Thrown at worker/online_restore.go:245

	}

	// TODO: after the drop, the tablets for the predicates stored in this group's
	// backup could be in a different group. The tablets need to be moved.

	// Reset tablets and set correct tablets to match the restored backup.
	creds := &x.MinioCredentials{
		AccessKey:    req.AccessKey,
		SecretKey:    req.SecretKey,
		SessionToken: req.SessionToken,
		Anonymous:    req.Anonymous,
	}
	uri, err := url.Parse(req.Location)
	if err != nil {
		return errors.Wrapf(err, "cannot parse backup location")
	}
	handler, err := NewUriHandler(uri, creds)
	if err != nil {
		return errors.Wrapf(err, "cannot create backup handler")
	}

	manifests, err := getManifestsToRestore(handler, uri, req)
	if err != nil {
		return errors.Wrapf(err, "cannot get backup manifests")
	}

	// filter manifests that needs to be restored
	mfsToRestore := manifests[:0]
	for _, m := range manifests {
		if (req.BackupNum == 0 || m.BackupNum <= req.BackupNum) &&
			(req.IncrementalFrom == 0 || m.BackupNum >= req.IncrementalFrom) {

			mfsToRestore = append(mfsToRestore, m)
		}
	}
	manifests = mfsToRestore

View on GitHub (pinned to 759e242be6)

Solutions

1. Check Alpha logs for the wrapped underlying error to see which handler/scheme was rejected.
2. Supply the correct credentials fields (AccessKey, SecretKey, SessionToken) in the restore request for s3/minio, or set Anonymous for public buckets.
3. Use an exactly supported scheme: s3://, minio://, gcs://, azure://, or a plain absolute path for local filesystem.
4. Ensure the restore request options are consistent — do not combine Anonymous with access keys.

Example fix

// before
{"location": "s3://bucket/backup", "anonymous": false}   // no keys provided
// after
{"location": "s3://bucket/backup", "accessKey": "AKIA...", "secretKey": "..."}

// Confirm scheme and credentials pair before restore
// s3/minio require AccessKey+SecretKey; public buckets can set Anonymous
if strings.HasPrefix(loc, "s3://") && accessKey == "" && !anonymous {
    return errors.New("s3 restore requires accessKey/secretKey or anonymous=true")
}

When it happens

Trigger: Location with an unknown scheme; missing required credentials for the scheme (AccessKey/SecretKey for s3/minio, SessionToken stale); inconsistent options (Anonymous:true plus access keys); handler construction rejecting the combination.

Common situations: Restoring from S3 without passing access/secret keys in the request; expired STS session token; typo'd scheme (s3a://, s3:/bucket); mixing anonymous access with provided keys; enterprise-feature scheme used on a build lacking it.

Related errors

• cannot get backup manifests
• another restore operation is already running
• Pending transactions found. Please retry operation
• while retrieving manifests
• cannot wait for restore ts %d

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/76a471c00929911c. Report an issue: GitHub.