AWS backup bucket create cannot succeed in orgs without the external-ID feature (iamRoleExternalId required by the library, rejected by the server)
Maintainers usually reply within 1 day
@sdairs is already working on this.
Since Nov 4, 2026.
Assessment
This issue has not been assessed yet.
Description
What happens
cloud backup bucket create --file for an AWS bucket has no input that works in an org without the external-ID feature:
- field omitted: client error
missing field iamRoleExternalId "x":BAD_REQUEST: iamRoleExternalId is not available for this organization"":BAD_REQUEST: iamRoleExternalId is invalidnull: client errorinvalid type: null, expected a string
Evidence
crates/clickhouse-cloud-api/src/models/backups.rs:631AwsBackupBucketPostRequestV1.iam_role_external_id: String(the PATCH type at :561 is already optional).crates/clickhousectl/src/cloud/backups.rs:551deserializes the config strictly into that type.- Spec
AwsBackupBucketPostRequestV1has norequired[]and no Optional marker, so the library treats the field as required. The server feature-gates it. docs/guides/cloud-service.md:136says the create schema requires a string.- Follow-up to #1106.
Expected vs actual
Expected: orgs without the feature can omit iamRoleExternalId, and it is not serialized. Actual: AWS create is impossible.
Likely cause
The spec marks the field required, but the server accepts it only for orgs that have the feature. Fix: make it Option<String> with skip_serializing_if (and record the exception where the analyzer expects it), ask the API team to mark it optional in the spec, and update the guide.
Scores
L=4 I=8
Basis
Validated by source review. Server responses come from the 2026-11-04 user-testing sweep.
From the 2026-11-04 user-testing sweep (medium severity): report finding 42. Checked against stack head 6859d2ac (PR 1220).
- Dominant language
- Rust
- Stars
- 80
- Forks
- 9
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 47
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ClickHouse/clickhousectl
-
cargo audit red on main: RUSTSEC-2026-0387 (crypto-bigint 0.5.5 via aws-config credentials-login)Possibly taken @sdairs claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ClickHouse/clickhousectl#1183 ·
Maintainers usually reply within 1 day
-
Reject empty positional IDs as usage errors instead of sending them to the APIPossibly taken @sdairs claimed this 1 day ago. Openbug cloud
ClickHouse/clickhousectl#1246 · 1 assignee ·
Maintainers usually reply within 1 day
-
Cloud file-reading flags report bare 'No such file or directory' without the flag or pathPossibly taken @sdairs claimed this 1 day ago. Openbug cloud
ClickHouse/clickhousectl#1244 · 1 assignee ·
Maintainers usually reply within 1 day
-
clickpipe create kafka/kinesis/pubsub: require --column, as object-storage doesPossibly taken @sdairs claimed this 1 day ago. Openbug cloud
ClickHouse/clickhousectl#1243 · 1 assignee ·
Maintainers usually reply within 1 day
-
clickpipe cdc-scaling update: a single --cpu-millicores or --memory-gb always fails, though help says omitted values are keptPossibly taken @sdairs claimed this 1 day ago. Openbug cloud
ClickHouse/clickhousectl#1242 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in ClickHouse/clickhousectl
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
nervosnetwork/fiber#1723 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 69/100
Maintainers usually reply within 1 day
-
needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 71/100
pbakaus/impeccable#1314 ·
Maintainers usually reply within 1 day
-
marmite skill: `curl ... | sh` is the first install method, bypassing review and integrity checksOpen
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
rochacbruno/marmite#565 ·