apache/beam · error · java.lang.RuntimeException

Can't read private key from provided path

Error message

Can't read private key from provided path

What it means

readPrivateKeyFile loads the raw bytes of a private key file and returns them as a UTF-8 string. When Files.readAllBytes throws IOException (file missing, unreadable, is a directory), it throws RuntimeException('Can't read private key from provided path').

Solutions

1. Check that the path is correct and absolute; test with a quick Files.exists(path) or ls on the runner.
2. Ensure the key file is staged with the job (container image, --filesToStage, or a GCS/URL location supported by SnowflakeIO).
3. Fix read permissions on the file for the user running the pipeline.
4. Wrap the call yourself to include the path in the message: read the bytes first with Files.readAllBytes and produce a clearer error.

Example fix

// before
String key = KeyPairUtils.readPrivateKeyFile("~/.snowflake/key.p8"); // '~' not expanded by Java
// after
String key = KeyPairUtils.readPrivateKeyFile(System.getProperty("user.home") + "/.snowflake/key.p8");

java.nio.file.Path p = java.nio.file.Paths.get(path);
if (!java.nio.file.Files.exists(p)) throw new IllegalArgumentException("Key file not found: " + p);
if (!java.nio.file.Files.isReadable(p)) throw new IllegalArgumentException("Key file not readable: " + p);

try {
  String key = KeyPairUtils.readPrivateKeyFile(path);
} catch (RuntimeException e) {
  throw new IllegalArgumentException("Failed to load private key at " + path + ": " + e.getMessage(), e);
}

When it happens

Trigger: Calling KeyPairUtils.readPrivateKeyFile(path) (or the SnowflakeIO .withPrivateKeyFile/reads path) with a path that does not exist, points to a directory, or is not readable by the process.

Common situations: Typo in the key path in pipeline options; key not distributed to Beam workers; running in a container image that doesn't include the key; path uses Windows backslashes on Linux workers.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• Can't read parse private key
• Can't create private key: + e.getMessage()
• Config file + configFile + does not exist
• Could not access keytab file. Make sure that the…
• Could not parse the provided Transform Service config file…

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/654674d3f7fa5301. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/KeyPairUtils.java:147

        throw new RuntimeException(
            "Invalid type of PEM file: "
                + pemObject.getType()
                + ". Supported types: "
                + ENCRYPTED_PRIVATE_KEY
                + ", "
                + UNENCRYPTED_PRIVATE_KEY);
      }
    } catch (IOException e) {
      throw new RuntimeException("Can't read parse private key");
    }
  }

  public static String readPrivateKeyFile(String privateKeyPath) {
    try {
      byte[] keyBytes = Files.readAllBytes(Paths.get(privateKeyPath));
      return new String(keyBytes, StandardCharsets.UTF_8);
    } catch (IOException e) {
      throw new RuntimeException("Can't read private key from provided path");
    }
  }
}

View on GitHub (pinned to 12126d8942)