apache/hadoop · error · IOException

SSE-C is enabled but no encryption key was declared in fs.s3

Error message

SSE-C is enabled but no encryption key was declared in fs.s3a.encryption.key

What it means

IOException thrown while building S3 client encryption settings: fs.s3a.encryption.algorithm is SSE-C but fs.s3a.encryption.key is empty. SSE-C is server-side encryption with customer-provided keys, so the key is mandatory; S3A looks it up (config or credential store, with password diagnostics) and fails fast at filesystem initialization.

Source

Thrown at hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java:1512

      // old key, global setting, for JCEKS entries.
      algorithm = lookupPassword(null, conf, SERVER_SIDE_ENCRYPTION_ALGORITHM);
    }
    // now determine the algorithm
    final S3AEncryptionMethods encryptionMethod = S3AEncryptionMethods.getMethod(algorithm);

    // look up the encryption key
    String encryptionKey = getS3EncryptionKey(bucket, conf,
        encryptionMethod.requiresSecret());
    int encryptionKeyLen =
        StringUtils.isBlank(encryptionKey) ? 0 : encryptionKey.length();
    String diagnostics = passwordDiagnostics(encryptionKey, "key");
    String encryptionContext = S3AEncryption.getS3EncryptionContextBase64Encoded(bucket, conf,
        encryptionMethod.requiresSecret());
    switch (encryptionMethod) {
    case SSE_C:
      LOG.debug("Using SSE-C with {}", diagnostics);
      if (encryptionKeyLen == 0) {
        throw new IOException(SSE_C_NO_KEY_ERROR);
      }
      break;

    case SSE_S3:
      if (encryptionKeyLen != 0) {
        throw new IOException(SSE_S3_WITH_KEY_ERROR
            + " (" + diagnostics + ")");
      }
      break;

    case SSE_KMS:
      LOG.debug("Using SSE-KMS with {}",
          diagnostics);
      break;

    case CSE_KMS:
      LOG.debug("Using CSE-KMS with {}",
          diagnostics);

View on GitHub (pinned to 2add963021)

Solutions

1. Set fs.s3a.encryption.key to the base-64-encoded AES-256 key SSE-C requires
2. If the key should come from a credential store, add it there and verify with hadoop credential list -provider ...
3. Check per-bucket overrides: fs.s3a.bucket.<bucket>.encryption.key must also be non-empty for buckets using SSE-C
4. If SSE-C was not intended, change or remove fs.s3a.encryption.algorithm

Example fix

<!-- before -->
<property><name>fs.s3a.encryption.algorithm</name><value>SSE-C</value></property>
<!-- fs.s3a.encryption.key missing -> IOException at fs init -->

<!-- after -->
<property><name>fs.s3a.encryption.algorithm</name><value>SSE-C</value></property>
<property><name>fs.s3a.encryption.key</name><value>base64-encoded-32-byte-key</value></property>

String alg = conf.getTrimmed("fs.s3a.encryption.algorithm", "");
if ("SSE-C".equalsIgnoreCase(alg)) {
  char[] key = conf.getPassword("fs.s3a.encryption.key");
  if (key == null || new String(key).trim().isEmpty()) {
    throw new IOException("SSE-C selected but fs.s3a.encryption.key is unset");
  }
}

catch IOException containing 'SSE-C is enabled but no encryption key' at filesystem initialization; surface as a configuration defect with the exact property to set - not retryable

When it happens

Trigger: fs.s3a.encryption.algorithm=SSE-C with fs.s3a.encryption.key unset, blank, or not resolvable through the configured credential provider; per-bucket SSE-C config (fs.s3a.bucket.<bucket>.encryption.key) missing while the bucket uses SSE-C.

Common situations: Adding SSE-C to an existing bucket config and forgetting the key; key stored in a JCEKS provider that is not deployed to worker nodes; blank/whitespace values after templating; encryption secrets lost when switching to delegation tokens.

Related errors

• Cannot find password option {key}
• AES256 is enabled but an encryption key was set in fs.s3a.en
• SimpleAWSCredentialsProvider: No AWS credentials in the Hado
• Unset property fs.s3a.assumed.role.arn
• Class {className} AWS provider class cannot be used (configu

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/c84e23606098fcfa. Report an issue: GitHub.