apache/flink · error · IllegalArgumentException

Unknown encryption type: {}. Supported values: none, sse-s3,

Error message

Unknown encryption type: {}. Supported values: none, sse-s3, sse-kms

What it means

S3EncryptionConfig.fromConfig normalizes fs.s3.encryption.type (lowercased) and maps sse-s3/aes256 to SSE-S3 and sse-kms/aws:kms to SSE-KMS; 'none'/absent disables encryption. Any other value falls into the default branch and throws this IllegalArgumentException listing the supported set. Note the accepted aliases: aes256 and aws:kms are legacy spellings carried over from the presto/hadoop filesystem options.

Source

Thrown at flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3EncryptionConfig.java:149

            @Nullable String encryptionTypeStr,
            @Nullable String kmsKeyId,
            Map<String, String> encryptionContext) {
        if (StringUtils.isNullOrWhitespaceOnly(encryptionTypeStr)
                || "none".equalsIgnoreCase(encryptionTypeStr)) {
            return none();
        }

        String normalizedType = encryptionTypeStr.toLowerCase(Locale.ROOT);

        switch (normalizedType) {
            case "sse-s3":
            case "aes256":
                return sseS3();
            case "sse-kms":
            case "aws:kms":
                return sseKms(kmsKeyId, encryptionContext);
            default:
                throw new IllegalArgumentException(
                        "Unknown encryption type: "
                                + encryptionTypeStr
                                + ". Supported values: none, sse-s3, sse-kms");
        }
    }

    public EncryptionType getEncryptionType() {
        return encryptionType;
    }

    @Nullable
    public String getKmsKeyId() {
        return kmsKeyId;
    }

    /**
     * Gets the encryption context for SSE-KMS.
     *

View on GitHub (pinned to 2f3c205e92)

Solutions

1. Set fs.s3.encryption.type to one of: none, sse-s3 (or aes256), sse-kms (or aws:kms).
2. For SSE-KMS also set fs.s3.kms-key.id (and optionally encryption context) — a valid type with missing key gives a different, clearer error.
3. If you need SSE-C or DSSE-KMS, this module does not support them; use SSE-KMS with a KMS key policy instead or contribute the feature.
4. Check for YAML quoting/casing typos: value is trimmed and lowercased, so only genuine spelling/alias mistakes reach the error.

Example fix

# before (flink-conf.yaml)
fs.s3.encryption.type: SSE

# after
fs.s3.encryption.type: sse-kms
fs.s3.kms-key.id: arn:aws:kms:us-east-1:123456789012:key/abcd-1234

static final Set<String> VALID = Set.of("none", "sse-s3", "aes256", "sse-kms", "aws:kms");
String t = conf.getOptional(S3_OPTIONS.encryptionType).orElse("none").trim().toLowerCase(Locale.ROOT);
if (!VALID.contains(t)) throw new IllegalArgumentException("fs.s3.encryption.type must be one of " + VALID + " but was '" + t + "'");

When it happens

Trigger: Setting fs.s3.encryption.type (s3.encryption.type) to values like SSE-S3 with different casing is fine (lowercased) but 'SSE', 'sse-c', 'kms', 'AES-128', 'aws:kms:dsse' or a typo like 'sse-km' hit the default branch. Also copying values valid for other filesystems (e.g. 'SSE-C', 'aws:kms:dsse' DSSE) that this module does not support.

Common situations: Config migration from hadoop-aws (which accepts SSE-KMS with different casing/keys); enabling SSE-C (customer keys) which is not implemented; trailing whitespace/quotes in YAML producing 'sse-kms ' handled by trim+lowercase but embedded values like 'sse_kms' (underscore) failing; copy-paste of 'aws:kms' is fine but 'AWS:KMS:' typo fails.

Related errors

• fs.s3.aws.credentials.provider is set but contains no valid
• Class {} does not implement AwsCredentialsProvider
• Failed to instantiate credentials provider: {}
• AWS region could not be determined. Set 's3.region' in Flink
• Failed to put object for key: {}

AI-assisted analysis of apache/flink@2f3c205e92 (2026-08-14). Data as JSON: /api/errors/44d8d8dbda69a4e0. Report an issue: GitHub.