From 535fe46007a02783fb47b4d861e27eb74385aace Mon Sep 17 00:00:00 2001
From: Even Rouault <even.rouault@spatialys.com>
Date: Tue, 10 Dec 2024 19:35:53 +0100
Subject: [PATCH] /vsis3/, /vsigs/, /vsiaz/: better error message when
 credentials aren't found

---
 port/cpl_aws.cpp          | 18 ++++++++++++++----
 port/cpl_azure.cpp        | 16 +++++++++++-----
 port/cpl_google_cloud.cpp | 18 ++++++++++++------
 3 files changed, 37 insertions(+), 15 deletions(-)

diff --git a/port/cpl_aws.cpp b/port/cpl_aws.cpp
index a417c72e96f5..8723f31e9d59 100644
--- a/port/cpl_aws.cpp
+++ b/port/cpl_aws.cpp
@@ -1973,10 +1973,20 @@ bool VSIS3HandleHelper::GetConfiguration(
         return true;
     }
 
-    VSIError(VSIE_AWSInvalidCredentials,
-             "AWS_SECRET_ACCESS_KEY and AWS_NO_SIGN_REQUEST configuration "
-             "options not defined, and %s not filled",
-             osCredentials.c_str());
+    CPLString osMsg;
+    osMsg.Printf(
+        "No valid AWS credentials found. "
+        "For authenticated requests, you need to set "
+        "AWS_SECRET_ACCESS_KEY, AWS_ACCESS_KEY_ID or other configuration "
+        "options, or create a %s file. Consult "
+        "https://gdal.org/en/stable/user/"
+        "virtual_file_systems.html#vsis3-aws-s3-files for more details. "
+        "For unauthenticated requests on public resources, set the "
+        "AWS_NO_SIGN_REQUEST configuration option to YES.",
+        osCredentials.c_str());
+    CPLDebug("GS", "%s", osMsg.c_str());
+    VSIError(VSIE_AWSInvalidCredentials, "%s", osMsg.c_str());
+
     return false;
 }
 
diff --git a/port/cpl_azure.cpp b/port/cpl_azure.cpp
index 00e25a36e025..71876b09a209 100644
--- a/port/cpl_azure.cpp
+++ b/port/cpl_azure.cpp
@@ -788,11 +788,17 @@ bool VSIAzureBlobHandleHelper::GetConfiguration(
     }
 
     const char *pszMsg =
-        "Missing AZURE_STORAGE_ACCOUNT+"
-        "(AZURE_STORAGE_ACCESS_KEY or AZURE_STORAGE_SAS_TOKEN or "
-        "AZURE_NO_SIGN_REQUEST) or "
-        "AZURE_STORAGE_CONNECTION_STRING "
-        "configuration options or Azure CLI configuration file";
+        "No valid Azure credentials found. "
+        "For authenticated requests, you need to set "
+        "AZURE_STORAGE_ACCOUNT, AZURE_STORAGE_ACCESS_KEY, "
+        "AZURE_STORAGE_SAS_TOKEN, "
+        "AZURE_STORAGE_CONNECTION_STRING, or other configuration "
+        "options. Consult "
+        "https://gdal.org/en/stable/user/"
+        "virtual_file_systems.html#vsiaz-microsoft-azure-blob-files "
+        "for more details. "
+        "For unauthenticated requests on public resources, set the "
+        "AZURE_NO_SIGN_REQUEST configuration option to YES.";
     CPLDebug("AZURE", "%s", pszMsg);
     VSIError(VSIE_AWSInvalidCredentials, "%s", pszMsg);
     return false;
diff --git a/port/cpl_google_cloud.cpp b/port/cpl_google_cloud.cpp
index 6855352c5ba6..86b38a0ff7ec 100644
--- a/port/cpl_google_cloud.cpp
+++ b/port/cpl_google_cloud.cpp
@@ -706,12 +706,18 @@ bool VSIGSHandleHelper::GetConfiguration(const std::string &osPathForOption,
     }
 
     CPLString osMsg;
-    osMsg.Printf("GS_SECRET_ACCESS_KEY+GS_ACCESS_KEY_ID, "
-                 "GS_OAUTH2_REFRESH_TOKEN or "
-                 "GOOGLE_APPLICATION_CREDENTIALS or "
-                 "GS_OAUTH2_PRIVATE_KEY+GS_OAUTH2_CLIENT_EMAIL and %s, "
-                 "or GS_NO_SIGN_REQUEST=YES configuration options not defined",
-                 osCredentials.c_str());
+    osMsg.Printf(
+        "No valid GCS credentials found. "
+        "For authenticated requests, you need to set "
+        "GS_SECRET_ACCESS_KEY, GS_ACCESS_KEY_ID, GS_OAUTH2_REFRESH_TOKEN, "
+        "GOOGLE_APPLICATION_CREDENTIALS, or other configuration "
+        "options, or create a %s file. Consult "
+        "https://gdal.org/en/stable/user/"
+        "virtual_file_systems.html#vsigs-google-cloud-storage-files "
+        "for more details. "
+        "For unauthenticated requests on public resources, set the "
+        "GS_NO_SIGN_REQUEST configuration option to YES.",
+        osCredentials.c_str());
 
     CPLDebug("GS", "%s", osMsg.c_str());
     VSIError(VSIE_AWSInvalidCredentials, "%s", osMsg.c_str());