Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

S3SubmitToArchiveCommand: StaticCredentialsProvider unconditionally constructed, blocking ECS Fargate task role credential resolution

Open Beginner friendly
  • Is something wrong?
#12,734 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
aws, java
Domain
backend, cloud

Research direction

The issue is in S3SubmitToArchiveCommand's createClient() method. Look for the AWS SDK credential provider chain construction. The fix is to conditionally add the StaticCredentialsProvider only when both access-key and secret-key are non-empty. Test by deploying a Dataverse instance on AWS ECS Fargate with an IAM task role and no configured S3 keys, then triggering a BagIt archival operation.

Written by the indexing model from the issue text.

Description

Type: Bug

What steps does it take to reproduce the issue?

Deploy Dataverse on AWS ECS Fargate with an IAM task role granting S3 access. Do not configure dataverse.s3archiver.access-key or dataverse.s3archiver.secret-key — rely solely on the task role for credentials.

Trigger a BagIt archival operation via S3SubmitToArchiveCommand.

  • When does this issue occur?

See above

  • Which page(s) does it occurs on?

N/A

  • What happens?

The container throws a NullPointerException during client construction in createClient(), and the archival operation fails before any S3 call is made.

  • To whom does it occur (all users, curators, superusers)?

All

  • What did you expect to happen?

Archival should succeed using IAM credentials from the ECS task role, consistent with how other AWS SDK clients behave on Fargate.

Which version of Dataverse are you using?

6.10.1

Any related open or closed issues to this bug report?

N/A

Screenshots:

N/A

Root cause

String accessKey = config.getOptionalValue("dataverse.s3archiver.access-key", String.class).orElse("");
String secretKey = config.getOptionalValue("dataverse.s3archiver.secret-key", String.class).orElse("");
AwsCredentialsProvider staticCredentials = StaticCredentialsProvider
        .create(AwsBasicCredentials.create(accessKey, secretKey));

When neither key is configured, both values are empty strings. AwsBasicCredentials.create("", "") throws an NPE.

Note: confirmed with a standalone test — AwsBasicCredentials.create("", "") throws java.lang.NullPointerException: Access key ID cannot be blank.

Suggested fix

Only add StaticCredentialsProvider to the chain when both keys are present and non-empty:

AwsCredentialsProviderChain.Builder chainBuilder = AwsCredentialsProviderChain.builder()
        .addCredentialsProvider(ProfileCredentialsProvider.create(profile));

if (!accessKey.isEmpty() && !secretKey.isEmpty()) {
    chainBuilder.addCredentialsProvider(
        StaticCredentialsProvider.create(AwsBasicCredentials.create(accessKey, secretKey)));
}

chainBuilder.addCredentialsProvider(DefaultCredentialsProvider.create());
s3CB.credentialsProvider(chainBuilder.build());

Are you thinking about creating a pull request for this issue?
If the approach is accepted, yes.

Dominant language
Java
Stars
1.1k
Forks
568
Avg merge
5d 10h
Merged PRs (30d)
21

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from IQSS/dataverse

All issues in IQSS/dataverse

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.