Hi Benoit Lebrun

Yes, it’s possible to run Mendix S3 storage using the AWS SDK’s Default Credentials Provider Chain (which includes ~/.aws/credentials) — but only if you do not set the Mendix access key/secret constants and you make sure the AWS credentials “environment” is actually visible to the JVM process (env vars, shared credentials file path, profile, region, permissions). Otherwise you’ll see the exact error you pasted.

Your error means the chain did not find valid credentials, so the S3 client was never created.

Remove these Mendix settings:

com.mendix.storage.s3.AccessKeyId

com.mendix.storage.s3.SecretAccessKey

(If they exist, Mendix will NOT use the default credentials chain.) [github.com]

Ensure the AWS credentials file is visible to the JVM:

Put credentials in ~/.aws/credentials, and make sure the Mendix runtime user actually has that home directory.

OR set:

ShellAWS_SHARED_CREDENTIALS_FILE=/path/to/credentialsAWS_PROFILE=defaultShow more lines

The default chain will then load it.

Set an AWS region (required for S3):

Use com.mendix.storage.s3.Region

OR set env var AWS_REGION=your-region.

Missing region causes S3 failures. [apidocs.rn...mendix.com]

I hope it helps

hi,

Yes, it is technically possible to use AWS credentials from a credentials file, but not automatically in the way you are attempting unless the AWS SDK credential provider chain is correctly configured and supported by the Mendix runtime environment.

Let’s clarify what is happening.

Why It Works With AccessKeyId / SecretAccessKey Properties

When you configure:

• com.mendix.storage.s3.AccessKeyId
• com.mendix.storage.s3.SecretAccessKey

Mendix directly initializes the S3 client using those explicit credentials.

When you remove them, Mendix falls back to the AWS SDK DefaultAWSCredentialsProviderChain.

If that chain cannot resolve credentials, you get the error:

S3 client not set … or environment for DefaultAWSCredentialsProviderChain needs to be set up

This means the AWS SDK could not find valid credentials in any of its supported sources.

How DefaultAWSCredentialsProviderChain Works

The AWS SDK checks credentials in this order:

1. Environment variables
   • AWS_ACCESS_KEY_ID
   • AWS_SECRET_ACCESS_KEY
2. Java system properties
   • aws.accessKeyId
   • aws.secretKey
3. ~/.aws/credentials file
4. IAM Role (if running on EC2 / ECS / EKS)

If none of these are available to the Mendix runtime process, credential resolution fails.

Why ~/.aws/credentials Is Not Working

In Mendix Cloud or other managed environments:

• The home directory of the runtime user may not be what you expect
• The file system may be ephemeral
• The Mendix runtime process may not have access to that path
• -Daws.sharedCredentialsFile may not be applied correctly to the runtime JVM

In Mendix Cloud specifically, access to arbitrary filesystem paths is restricted.

Best Practices

1. Mendix Cloud

If running in Mendix Cloud:

Use environment variables instead of credentials file.

Set in Environment Variables:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY

Or preferably:

Use IAM roles if supported by the hosting environment.

This aligns with AWS and Mendix best practices.

2. On-Premise / Private Cloud

If running on your own infrastructure:

You can use the credentials file provided that:

• The runtime user has access to the home directory
• The file exists at the correct path
• Permissions are correct
• The JVM parameter is correctly applied

Example JVM parameter:

-Daws.sharedCredentialsFile=/path/to/.aws/credentials

Additionally, ensure the profile is either default or specify:

-Daws.profile=your-profile-name

Important Clarification About the Error Message

When it says:

"environment for DefaultAWSCredentialsProviderChain needs to be set up"

It means:

The AWS SDK credential resolution chain could not find valid credentials in:

• Environment variables
• JVM properties
• Credentials file
• IAM role

It does not refer to Mendix environment specifically, but to AWS SDK environment configuration.

Enterprise Recommendation

For production systems:

• Avoid hardcoding credentials in Mendix constants
• Avoid relying on local credential files in cloud deployments
• Prefer environment variables or IAM roles
• Follow AWS security best practices

This ensures:

• Better security
• Easier rotation of credentials
• Cleaner deployment configuration
• Compliance with cloud-native architecture

Yes, using a credentials file is possible in self-managed environments if the AWS SDK can access it.

However, in Mendix Cloud environments, the recommended and supported approach is to use environment variables or IAM-based authentication rather than relying on ~/.aws/credentials.

This behavior is consistent with AWS SDK credential resolution design and Mendix S3 storage configuration.

Thank you for help but that doesn't work.

On my Mendix Studio Pro, in my setting, I set up the following custom configurations :

• com.mendix.core.StorageService : com.mendix.storage.s3
• com.mendix.storage.s3.BucketName : my-bucket
• com.mendix.storage.s3.EndPoint : the-endpoint
• com.mendix.storage.s3.Region :eu-central-1

And in Extra JVM parameters :

-Daws.sharedCredentialsFile="C:\temp\myapp\.aws\credentials" -Daws.profile=default

I get the same error. I tried different values for the sharedCredentialsFile.