Enum S3CredentialError 

pub enum S3CredentialError {
    EmptyAccessKeyId,
    EmptySecret,
    BoatrampRefOnCluster(String),
    NoEnvelope,
    MissingBoatrampSecret(String),
    EnvRefNotPermitted(String),
    EnvVarUnset(String),
    UnsupportedScheme(String),
    Backend(String),
    NotUtf8,
}

A failure resolving the node-level base S3 credential. Stringly at the boundary (the caller maps it into its serve error), but the variants keep the failure kinds distinct so the mutation gate can assert on the fail-closed one.

Variants

EmptyAccessKeyId

access_key_id is empty (a misconfigured source — refuse rather than mint a broken credential).

EmptySecret

The resolved secret_access_key is empty (an env:VAR="" or a boatramp: secret sealed as empty bytes) — fail closed at startup rather than mint a static provider that fails SigV4 at request-time (403). Symmetric to Self::EmptyAccessKeyId.

BoatrampRefOnCluster(String)

A boatramp:<name> node-cred ref on the CLUSTER path — refused structurally (a scheme check, not an incidental empty-store miss): the replicated control-plane KV that holds the sealed store is not available at blob-build time on a cluster. Use env:<VAR> instead.

NoEnvelope

The secret_access_key is a boatramp:/env: sealed ref but no [secrets] envelope is configured — fail closed (never a silent env fallback that would mask the misconfig).

MissingBoatrampSecret(String)

A boatramp: ref, but the sealed secret is not present in the store under the default project.

EnvRefNotPermitted(String)

An env:/bare host-env ref refused because the posture’s allow_env_secret_refs is off (the config author’s env is the operator’s namespace — the same gate a guest env: ref hits).

EnvVarUnset(String)

An env:/bare host-env ref whose var is unset.

UnsupportedScheme(String)

A reserved-but-unimplemented scheme (a colon-bearing value whose scheme is not env/boatramp).

Backend(String)

A KV / envelope (unseal) backend failure — detail is logged, not surfaced to a client.

NotUtf8

A resolved secret that is not valid UTF-8 (an AWS secret access key is ASCII).

Trait Implementations

impl Debug for S3CredentialError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for S3CredentialError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for S3CredentialError

impl Error for S3CredentialError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl PartialEq for S3CredentialError

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for S3CredentialError