Elasticsearch AWS S3 Snapshot Repository Authentication Error Details

Direct answer

No existing Elasticsearch repository setting forces the snapshot API to return AWS-specific error codes or HTTP status codes for S3-backed repositories. Authentication failures are reported as generic snapshot or repository errors. There is no supported read-only endpoint or repository flag that validates S3 credentials without starting a snapshot. Repository creation may perform a basic connectivity check in some releases, but it is not a guaranteed credential validation.

Confirmed behavior and likely explanation

Confirmed: AWS error codes such as InvalidToken or SignatureDoesNotMatch, and HTTP statuses such as 403, are typically written to Elasticsearch server logs rather than returned in the REST response body. A generic snapshot failed status can therefore hide expired or misconfigured credentials. Client retry logic may transiently succeed on temporary network issues while the underlying credential problem persists.

Likely explanation: The snapshot/restore layer maps provider errors into Elasticsearch's generic error model before sending the response, so provider-specific details are omitted from the client. Behavior may differ across Elasticsearch releases, and newer versions might include more detail, but no specific version change is confirmed without checking the target release notes.

Steps for this case

1. Inspect Elasticsearch server logs at snapshot failure time for AWS SDK exceptions and error codes such as InvalidToken, SignatureDoesNotMatch, or HTTP 403.
2. Correlate repeated failures with log entries instead of treating them as intermittent network errors.
3. Refresh or rotate S3 credentials if logs show expired tokens or signature mismatches.
4. Validate credentials by running a snapshot against a test index or non-production repository, since no read-only validation endpoint is supported.

Safe verification commands

# List existing repositories (read-only)
curl -s -X GET "localhost:9200/_snapshot?pretty"

# Inspect recent Elasticsearch logs for AWS errors
tail -n 100 /var/log/elasticsearch/elasticsearch.log | grep -i -E "s3|invalidtoken|signaturedoesnotmatch|403"

Log paths vary by installation. Do not include AWS secret keys in diagnostic output.

Missing diagnostic detail

Which Elasticsearch version are you running? Whether newer versions include HTTP or AWS error codes in the snapshot error payload depends on the release, and this has not been confirmed. Provide the version so the recommendation can be checked against that release's changelog and snapshot/restore documentation.