diff --git a/src/main/java/com/aliyun/openservices/log/common/auth/CredentialsProvider.java b/src/main/java/com/aliyun/openservices/log/common/auth/CredentialsProvider.java
index 81fdbbe1..b7c55fbd 100644
--- a/src/main/java/com/aliyun/openservices/log/common/auth/CredentialsProvider.java
+++ b/src/main/java/com/aliyun/openservices/log/common/auth/CredentialsProvider.java
@@ -1,5 +1,10 @@
 package com.aliyun.openservices.log.common.auth;
 
 public interface CredentialsProvider {
+    /**
+     * This method is called everytime AccessKeyId/AccessKeySecret/StsToken is needed by log client,
+     * the {@link CredentialsProvider} should cache credentials to avoid update credentials too frequently.
+     * @note This method must be thread safe to avoid data race.
+     */
     Credentials getCredentials();
 }
diff --git a/src/main/java/com/aliyun/openservices/log/common/auth/ECSRoleCredentialsProvider.java b/src/main/java/com/aliyun/openservices/log/common/auth/ECSRoleCredentialsProvider.java
index 0ab2e74f..591615f7 100644
--- a/src/main/java/com/aliyun/openservices/log/common/auth/ECSRoleCredentialsProvider.java
+++ b/src/main/java/com/aliyun/openservices/log/common/auth/ECSRoleCredentialsProvider.java
@@ -20,6 +20,6 @@ public Credentials getCredentials() {
     }
 
 
-    private TemporaryCredentials credentials;
+    private volatile TemporaryCredentials credentials;
     private final CredentialsFetcher fetcher;
 }