DVC "failed to pull data from the cloud" (remote auth) in CI

DVC located the remote but could not authenticate to it from CI, so it reports "failed to pull data from the cloud" with a count of files it could not fetch. The remote config is fine; the credentials are missing on the runner.

What this error means

dvc pull prints per-file failures and ends with "ERROR: failed to pull data from the cloud - N files failed to download". It works locally where cloud credentials are present.

ERROR: failed to pull data from the cloud - 4 files failed to download

Common causes

Cloud credentials are not exposed to the runner

The developer machine has ambient AWS/GCS/Azure credentials, but CI has none injected, so DVC cannot authenticate to the remote.

The credentials lack read access to the bucket

A key or role reached the remote but is not authorized to read the DVC store path, so every object fetch fails.

How to fix it

Inject remote credentials into the job

1. Store the cloud credentials as repository or organization secrets.
2. Expose them to the DVC step via env or an OIDC role.
3. Re-run dvc pull and confirm downloads succeed.

- name: Pull data
  env:
    AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
    AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  run: dvc pull

Prefer short-lived OIDC credentials

Assume a cloud role via OIDC so no long-lived keys sit in secrets, then pull.

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/dvc-ci
    aws-region: us-east-1
- run: dvc pull

How to prevent it

• Provision remote credentials in CI, never rely on ambient local ones.
• Grant the CI principal least-privilege read on the DVC store path.
• Test dvc pull in a clean environment to catch missing credentials early.

Related guides