apache/hadoop · error · IllegalArgumentException

Invalid client side encryption algorithm. Only CSE-KMS and C

Error message

Invalid client side encryption algorithm. Only CSE-KMS and CSE-CUSTOM are supported

What it means

IllegalArgumentException from CSEUtils.getClientSideEncryptionMaterials' default branch: the S3AEncryptionMethods value passed in is neither CSE_KMS nor CSE_CUSTOM. The switch constructs CSEMaterials for exactly those two client-side-encryption modes (CSE_KMS additionally requires a non-empty KMS key id, CSE_CUSTOM requires a keyring class name). Reaching the default means the method was invoked with a non-CSE algorithm such as SSE-KMS or SSE-S3 -- the caller is expected to have already established the algorithm is CSE.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/impl/CSEUtils.java:194

    case CSE_KMS:
      String kmsKeyId = getS3EncryptionKey(bucket, conf, true);
      Preconditions.checkArgument(kmsKeyId != null && !kmsKeyId.isEmpty(),
          "KMS keyId cannot be null or empty");
      return new CSEMaterials()
          .withCSEKeyType(CSEMaterials.CSEKeyType.KMS)
          .withConf(conf)
          .withKmsKeyId(kmsKeyId);
    case CSE_CUSTOM:
      String customCryptoClassName = conf.getTrimmed(S3_ENCRYPTION_CSE_CUSTOM_KEYRING_CLASS_NAME);
      Preconditions.checkArgument(customCryptoClassName != null &&
              !customCryptoClassName.isEmpty(),
          "CSE custom cryptographic class name cannot be null or empty");
      return new CSEMaterials()
          .withCSEKeyType(CSEMaterials.CSEKeyType.CUSTOM)
          .withConf(conf)
          .withCustomCryptographicClassName(customCryptoClassName);
    default:
      throw new IllegalArgumentException("Invalid client side encryption algorithm."
          + " Only CSE-KMS and CSE-CUSTOM are supported");
    }
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Use only CSE-KMS or CSE-CUSTOM with this API; server-side algorithms (SSE-S3, SSE-KMS, SSE-C) must not be routed here
2. Check spelling of fs.s3a.encryption.algorithm: valid CSE values are 'CSE-KMS' and 'CSE-CUSTOM' (older versions fail earlier at enum parse if the token is unknown)
3. For CSE-KMS set fs.s3a.encryption.key; for CSE-CUSTOM set fs.s3a.encryption.keyring.class -- the Preconditions before this branch enforce them
4. On custom forks, add a switch case for any new CSE enum constant

Example fix

<!-- before -->
<property><name>fs.s3a.encryption.algorithm</name><value>SSE-KMS</value></property>
<!-- ...routed into CSE materials creation -->

<!-- after: use the CSE spelling only when CSE is intended -->
<property><name>fs.s3a.encryption.algorithm</name><value>CSE-KMS</value></property>
<property><name>fs.s3a.encryption.key</name><value>arn:aws:kms:...:key/...</value></property>

String algo = conf.getTrimmed("fs.s3a.encryption.algorithm", "SSE-S3");
if (algo.startsWith("CSE")
    && !Arrays.asList("CSE-KMS", "CSE-CUSTOM").contains(algo)) {
  throw new IllegalArgumentException("Unsupported CSE algorithm: " + algo
      + " (only CSE-KMS and CSE-CUSTOM)");
}

try {
  CSEMaterials m = CSEUtils.getClientSideEncryptionMaterials(conf, bucket, algorithm);
} catch (IllegalArgumentException e) {
  // config-side failure: fix fs.s3a.encryption.algorithm before recreating the client
  throw new ConfigurationException("Bad CSE configuration", e);
}

When it happens

Trigger: Directly calling getClientSideEncryptionMaterials with an algorithm enum that is not a CSE variant, or a fork/new enum constant that is client-side-encrypting but was not given a case here.

Common situations: Library misuse: routing all encryption algorithms into the CSE materials factory; setting fs.s3a.encryption.algorithm to a server-side value (e.g. SSE-KMS) on a code path that assumes CSE; new encryption methods added to S3AEncryptionMethods in newer hadoop-aws without extending this switch.

Related errors

• Failed to parse value %s as %s, property key %s
• Unsupported block buffer "{name}"
• maxRetries = ${maxRetries} < 0
• sleepTime = ${sleepTime} < 0
• numRetries = ${numRetries} < 0

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/9e96d7448b050152. Report an issue: GitHub.