dotnet/orleans · error · InvalidOperationException

AWS named profile '{this._profileName}' provided, but creden

Error message

AWS named profile '{this._profileName}' provided, but credentials could not be retrieved

What it means

Thrown by DynamoDBStorage.CreateClient when a ProfileName was configured but CredentialProfileStoreChain.TryGetAWSCredentials could not find credentials for that named profile. The provider prefers explicit access/secret keys, then a named profile, then implicit (EC2/ECS IAM) auth; the profile branch failing means the named profile is unknown to the AWS SDK's credential store on this host.

Source

Thrown at src/AWS/Shared/Storage/DynamoDBStorage.cs:176

                var credentials = new BasicAWSCredentials(this._accessKey, this.secretKey);
                this._ddbClient = new AmazonDynamoDBClient(credentials, new AmazonDynamoDBConfig { RegionEndpoint = AWSUtils.GetRegionEndpoint(this._service) });
            }
            else if (!string.IsNullOrEmpty(this._profileName))
            {
                // AWS DynamoDB instance (auth via explicit credentials and token found in a named profile)
                var chain = new CredentialProfileStoreChain();
                if (chain.TryGetAWSCredentials(this._profileName, out var credentials))
                {
                    this._ddbClient = new AmazonDynamoDBClient(
                        credentials,
                        new AmazonDynamoDBConfig
                        {
                            RegionEndpoint = AWSUtils.GetRegionEndpoint(this._service)
                        });
                }
                else
                {
                    throw new InvalidOperationException(
                        $"AWS named profile '{this._profileName}' provided, but credentials could not be retrieved");
                }
            }
            else
            {
                // AWS DynamoDB instance (implicit auth - EC2 IAM Roles etc)
                this._ddbClient = new AmazonDynamoDBClient(new AmazonDynamoDBConfig { RegionEndpoint = AWSUtils.GetRegionEndpoint(this._service) });
            }
        }

        private async Task<TableDescription?> GetTableDescription(string tableName, CancellationToken cancellationToken = default)
        {
            try
            {
                var description = await _ddbClient.DescribeTableAsync(tableName, cancellationToken);
                if (description.Table != null)
                    return description.Table;
            }

View on GitHub (pinned to fca799fa70)

Solutions

1. Create the named profile in ~/.aws/credentials (or the configured credential store) on the host/container running the silo.
2. If running on EC2/ECS/EKS with an IAM role, remove ProfileName so the implicit-auth branch is used.
3. Switch to explicit AccessKey/SecretKey/Token in config (or, better, a secrets store) if a named profile is not feasible.
4. Double-check the profile name spelling and that the process runs as the user that owns the credentials file.

Example fix

// before: named profile that does not exist on the host
opt.ProfileName = "prod-deploy";

// after (option A): create the profile on the host
// [prod-deploy]
// aws_access_key_id = ...
// aws_secret_access_key = ...

// after (option B): drop the profile and rely on the EC2/ECS IAM role
opt.ProfileName = null;
// (or set explicit keys from a secrets manager)

// If a named profile is configured, verify it resolves before starting the silo
var chain = new CredentialProfileStoreChain();
if (!string.IsNullOrEmpty(opt.ProfileName) && !chain.TryGetAWSCredentials(opt.ProfileName, out _))
    throw new InvalidOperationException($"AWS profile '{opt.ProfileName}' not found; create it or drop ProfileName to use IAM role auth");

static bool ProfileResolves(string? profileName)
{
    if (string.IsNullOrEmpty(profileName)) return true;
    return new CredentialProfileStoreChain().TryGetAWSCredentials(profileName, out _);
}

try { silo.StartAsync(); }
catch (InvalidOperationException ix) when (ix.Message.Contains("credentials could not be retrieved"))
{
    _logger.LogCritical("AWS named profile not found on this host; create it or rely on IAM role auth");
    throw;
}

When it happens

Trigger: Produced during DynamoDBStorage construction (silo init) when options.ProfileName is set but no matching profile exists in the shared AWS credentials file (~/.aws/credentials) or the SDK credential store. Triggered by a deployment that expects a named profile that was never created, was created under a different user, or lives on a different machine/container image.

Common situations: Local profile name set in config but the credentials file is missing in the container; CI/CD running as a user without ~/.aws/credentials; profile name typo; AWS_PROFILE env var mismatch; running in EC2 where IAM role auth should be used instead of a named profile.

Related errors

• Configuration for DynamoDBGrainStorage {name} is invalid. Ta
• Configuration for DynamoDBGrainStorage {name} is invalid. Re
• Configuration for DynamoDBGrainStorage {name} is invalid. Wr
• Data too large to write to DynamoDB table. Size={dataSize} M
• No IStreamQueueCheckpointer is configured with PersistentStr

AI-assisted analysis of dotnet/orleans@fca799fa70 (2026-08-13). Data as JSON: /api/errors/639bea7324b0a65d. Report an issue: GitHub.