@Rocky getting this error when trying to query while using vended credentials for Azure: "Failed to get status for file: abfs:///..." - this is for both SELECT and INSERT

The error "Failed to get status for file: abfs:///..." typically occurs when the StarRocks storage client (Hadoop Azure client) is unable to authenticate or access the specified path in Azure Data Lake Storage Gen2 (ADLS Gen2). Since you are using vended credentials (temporary credentials issued by an Iceberg REST Catalog like Apache Polaris or Unity Catalog), here are the most common causes and troubleshooting steps: 1. Insufficient Azure RBAC Permissions The credentials "vended" by the catalog inherit the permissions of the principal configured in the catalog. Ensure that the principal (Service Principal or Managed Identity) used by the catalog has the following roles assigned in Azure for the storage account or container: * For SELECT:

Storage Blob Data Reader

. * For INSERT:

Storage Blob Data Contributor

. 2. SAS Token Scope and Expiration Vended credentials for Azure are typically short-lived SAS (Shared Access Signature) tokens. * Expiration: If the query takes longer than the token's TTL, it will fail. Check if the catalog's token lifetime is too short. * Scope: The token must be generated for the correct container and path. If the catalog provides a token scoped only to a specific sub-directory, but StarRocks tries to access a higher-level "status" or metadata file, it will fail. * Permissions in Token: Ensure the catalog is requesting both

read

and

write

permissions for the SAS token if you are performing

INSERT

. 3. Network Restrictions (Firewall/VNET) Even with correct credentials, the request will fail if the storage account's firewall blocks StarRocks. * Check if "Public network access" is disabled or restricted to "Selected networks" in the Azure Storage Account. * If restricted, ensure the IP addresses of all StarRocks BE (Backend) and CN (Compute Node) nodes are whitelisted. 4. URI Protocol and Path * Ensure you are using the correct protocol:

abfs://<container>@<account>.<http://dfs.core.windows.net/<path|dfs.core.windows.net/<path>>

or

abfss://

for HTTPS. * If the error message shows

abfs:///

(three slashes or missing account/container details), it might indicate a malformed URI in your Catalog configuration or a bug in how the catalog is resolving the file path. 5. Troubleshooting Steps 1. Check FE/BE Logs: Look at the

<http://be.INFO|be.INFO>

or

be.WARNING

logs on the backend nodes for a more detailed Java stack trace. It often contains the underlying Azure error code (e.g.,

403 Forbidden

or

404 Not Found

). 2. Verify Catalog Logs: Check the logs of your REST Catalog (e.g., Polaris) to ensure it is successfully vending the credentials and not returning an empty or error response. 3. Test with Static Credentials: To isolate the issue, try creating a temporary external catalog using a Shared Key or Service Principal directly in the

PROPERTIES

. If this works, the issue is definitely with the "vended" credential generation or scope.

sql
-- Example for testing with static Service Principal
CREATE EXTERNAL CATALOG azure_test
PROPERTIES (
    "type" = "iceberg",
    "iceberg.catalog.type" = "rest",
    "uri" = "http://<catalog_uri>",
    "azure.adls2.oauth2_client_id" = "<client_id>",
    "azure.adls2.oauth2_client_secret" = "<client_secret>",
    "azure.adls2.oauth2_client_endpoint" = "<https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token>"
);

References • sql-reference/information_schema/stream_loads.md • sql-reference/information_schema/loads.md • sql-reference/information_schema/routine_load_jobs.md