diff --git a/weed/s3api/s3api_embedded_iam.go b/weed/s3api/s3api_embedded_iam.go
index 3c33369fb..e5648b9bd 100644
--- a/weed/s3api/s3api_embedded_iam.go
+++ b/weed/s3api/s3api_embedded_iam.go
@@ -1047,6 +1047,9 @@ func (e *EmbeddedIamApi) ExecuteAction(values url.Values) (interface{}, *iamErro
 	case "ListAccessKeys":
 		// Note: handleImplicitUsername requires request context which we don't have here for gRPC
 		// gRPC callers must provide UserName explicitly
+		if values.Get("UserName") == "" {
+			return nil, &iamError{Code: s3err.GetAPIError(s3err.ErrInvalidRequest).Code, Error: fmt.Errorf("UserName is required")}
+		}
 		response = e.ListAccessKeys(s3cfg, values)
 		changed = false
 	case "CreateUser":