risingwavelabs/risingwave · error · SinkError::Kinesis

error building Kinesis client: {err}

Error message

error building Kinesis client: {err}

What it means

The AWS SDK Kinesis client construction (credentials, region, endpoint resolution) failed inside KinesisSinkWriter::new. The SDK error is wrapped into SinkError::Kinesis, so sink creation is aborted before any record is sent.

Source

Thrown at src/connector/src/sink/kinesis.rs:200

        pk_indices: Vec<usize>,
        format_desc: &SinkFormatDesc,
        db_name: String,
        sink_from_name: String,
    ) -> Result<Self> {
        let formatter = SinkFormatterImpl::new(
            format_desc,
            schema,
            pk_indices,
            db_name,
            sink_from_name,
            &config.common.stream_name,
        )
        .await?;
        let client = config
            .common
            .build_client()
            .await
            .map_err(|err| SinkError::Kinesis(anyhow!(err)))?;
        Ok(Self {
            config: config.clone(),
            formatter,
            client,
        })
    }

    fn new_payload_writer(&self) -> KinesisSinkPayloadWriter {
        KinesisSinkPayloadWriter {
            client: self.client.clone(),
            entries: vec![],
            stream_name: self.config.common.stream_name.clone(),
        }
    }
}

mod opaque_type {
    use std::cmp::min;

View on GitHub (pinned to 6469eb736d)

Solutions

1. Set AWS credentials and region in the sink WITH options (aws.credentials.access_key_id/secret_access_key, aws.region)
2. Or export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION in the compute-node environment
3. Verify any custom `endpoint` URL is valid and reachable
4. Check IAM role/instance-profile configuration if relying on implicit credentials

Example fix

// before
WITH ( connector='kinesis', stream='s1' )
// after
WITH ( connector='kinesis', stream='s1',
       aws.region='us-east-1',
       aws.credentials.access_key_id='...', aws.credentials.secret_access_key='...' )

// before creating the sink, ensure creds/region resolve
if std::env::var("AWS_REGION").is_err()
   && !props.contains_key("aws.region") {
  return Err("aws.region (or AWS_REGION) is required".into());
}
if !props.contains_key("aws.credentials.access_key_id")
   && std::env::var("AWS_ACCESS_KEY_ID").is_err() {
  return Err("AWS credentials required".into());
}

match writer_result {
  Ok(w) => w,
  Err(SinkError::Kinesis(e)) => {
    eprintln!("kinesis client init failed (check AWS creds/region/endpoint): {e:#}");
    std::process::exit(1);
  }
}

When it happens

Trigger: `config.common.build_client()` returning Err during sink writer creation — e.g. missing/invalid AWS credentials or an unresolvable region/endpoint.

Common situations: Missing `aws.credentials`/`aws.region` in WITH options or environment (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION); typos in custom endpoint URL; unreachable assumed-role/STS endpoint.

Related errors

• should not fail because we have set `data` and `partition_ke
• Kinesis got an unhandled error on stream {:?}, shard {:?}
• shard iterator is none
• Both `access_key` and `secret_key` must be provided
• failed to parse static creds

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/83d1a0266411ac2c. Report an issue: GitHub.