infiniflow/ragflow · error · ConnectorMissingCredentialError

Unsupported S3 authentication method

Error message

Unsupported S3 authentication method

What it means

The S3 auth dispatcher accepts only 'access_key', 'iam_role', and 'assume_role'; any other value for authentication_method raises ConnectorMissingCredentialError('Unsupported S3 authentication method').

Source

Thrown at common/data_source/blob_connector.py:103

            if not all(credentials.get(key) for key in ["r2_access_key_id", "r2_secret_access_key", "account_id"]):
                raise ConnectorMissingCredentialError("Cloudflare R2")

        elif self.bucket_type == BlobType.S3:
            authentication_method = credentials.get("authentication_method", "access_key")

            if authentication_method == "access_key":
                if not all(credentials.get(key) for key in ["aws_access_key_id", "aws_secret_access_key"]):
                    raise ConnectorMissingCredentialError("Amazon S3")

            elif authentication_method == "iam_role":
                if not credentials.get("aws_role_arn"):
                    raise ConnectorMissingCredentialError("Amazon S3 IAM role ARN is required")

            elif authentication_method == "assume_role":
                pass

            else:
                raise ConnectorMissingCredentialError("Unsupported S3 authentication method")

        elif self.bucket_type == BlobType.GOOGLE_CLOUD_STORAGE:
            if not all(credentials.get(key) for key in ["access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Google Cloud Storage")

        elif self.bucket_type == BlobType.OCI_STORAGE:
            if not all(credentials.get(key) for key in ["namespace", "region", "access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Oracle Cloud Infrastructure")

        elif self.bucket_type == BlobType.S3_COMPATIBLE:
            if not all(credentials.get(key) for key in ["endpoint_url", "aws_access_key_id", "aws_secret_access_key", "addressing_style"]):
                raise ConnectorMissingCredentialError("S3 Compatible Storage")

        else:
            raise ValueError(f"Unsupported bucket type: {self.bucket_type}")

        # Create S3 client
        self.s3_client = create_s3_client(self.bucket_type, credentials, self.european_residency)

View on GitHub (pinned to 554fb1133a)

Solutions

1. Set authentication_method to exactly one of: access_key, iam_role, assume_role
2. Add an allowlist check in config-building code so invalid values fail loudly before connector construction

Example fix

// before
creds = {"authentication_method": "iam", "aws_role_arn": "arn:..."}

// after
creds = {"authentication_method": "iam_role", "aws_role_arn": "arn:..."}

ALLOWED = {"access_key", "iam_role", "assume_role"}
method = creds.get("authentication_method", "access_key")
if method not in ALLOWED:
    raise ValueError(f"authentication_method must be one of {sorted(ALLOWED)}, got {method!r}")

def is_supported_s3_auth_method(m) -> bool:
    """True when m is one of the connector's supported S3 auth methods."""
    return m in {"access_key", "iam_role", "assume_role"}

try:
    blob.load_credentials(creds)
except ConnectorMissingCredentialError as e:
    if "Unsupported S3 authentication method" in str(e):
        creds["authentication_method"] = "access_key"  # or iam_role as intended
        blob.load_credentials(creds)

When it happens

Trigger: authentication_method set to something like 'iam', 'role', 'keys', 'session', or an unset-with-typo value (note: a missing key defaults to 'access_key', so this only fires on a present-but-unknown value).

Common situations: Config authored from memory with a plausible-but-wrong method name; enum values changing across connector versions; frontend sending display labels instead of machine values.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• main() must return a value. Use null for an empty result.
• main() returned a non-JSON-serializable value.
• message.compileNotSupported
• Failed to fetch search detail
• Invalid activate_status: {activate_status}

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/87a02527099b8795. Report an issue: GitHub.