What causes "Cannot support given S3 encryption type: " in apache/iceberg?

Set s3.sse-type to exactly one of the supported values (e.g. SSE-S3, SSE-KMS, SSE-C, NONE) as spelled in the docs.

apache/iceberg · error · IllegalArgumentException

Cannot support given S3 encryption type:

Error message

Cannot support given S3 encryption type:

What it means

S3RequestUtil.configureEncryption() switches over the configured server-side encryption type and throws IllegalArgumentException in the default branch when the value is not one of NONE/SSE-S3/SSE-KMS/SSE-C. The s3.sse-type property holds an unknown value.

Source

Thrown at aws/src/main/java/org/apache/iceberg/aws/s3/S3RequestUtil.java:131

      case S3FileIOProperties.DSSE_TYPE_KMS:
        encryptionSetter.apply(ServerSideEncryption.AWS_KMS_DSSE);
        kmsKeySetter.apply(s3FileIOProperties.sseKey());
        break;

      case S3FileIOProperties.SSE_TYPE_S3:
        encryptionSetter.apply(ServerSideEncryption.AES256);
        break;

      case S3FileIOProperties.SSE_TYPE_CUSTOM:
        // setters for SSE-C exist for all request builders, no need to check null
        customAlgorithmSetter.apply(ServerSideEncryption.AES256.name());
        customKeySetter.apply(s3FileIOProperties.sseKey());
        customMd5Setter.apply(s3FileIOProperties.sseMd5());
        break;

      default:
        throw new IllegalArgumentException(
            "Cannot support given S3 encryption type: " + s3FileIOProperties.sseType());
    }
  }

  static void configurePermission(
      S3FileIOProperties s3FileIOProperties, PutObjectRequest.Builder requestBuilder) {
    configurePermission(s3FileIOProperties, requestBuilder::acl);
  }

  static void configurePermission(
      S3FileIOProperties s3FileIOProperties, CreateMultipartUploadRequest.Builder requestBuilder) {
    configurePermission(s3FileIOProperties, requestBuilder::acl);
  }

  @SuppressWarnings("ReturnValueIgnored")
  static void configurePermission(
      S3FileIOProperties s3FileIOProperties,
      Function<ObjectCannedACL, S3Request.Builder> aclSetter) {

View on GitHub (pinned to 86d9c8fc54)

Solutions

Set s3.sse-type to exactly one of the supported values (e.g. SSE-S3, SSE-KMS, SSE-C, NONE) as spelled in the docs.
Use s3.sse-key/s3.sse-md5 together with SSE-C; s3.sse-key-id for SSE-KMS.
Upgrade Iceberg if you need an encryption type added in a newer release.
Omit s3.sse-type entirely to use default (no explicit) encryption.

Example fix

// before
props.put("s3.sse-type", "sse_kms");
// after
props.put("s3.sse-type", "SSE-KMS");
props.put("s3.sse-key-id", "arn:aws:kms:us-east-1:123:key/abc");

Defensive patterns

Strategy: validation

Validate before calling

// Java
String sse = props.getProperty("s3.sse-type");
Set<String> valid = Set.of("NONE", "SSE-S3", "SSE-KMS", "SSE-C");
if (sse != null && !valid.contains(sse)) {
  throw new IllegalArgumentException("Invalid s3.sse-type: " + sse);
}

Try / catch

// Java
try {
  io.newOutputFile(loc).createOrOverwrite();
} catch (IllegalArgumentException e) {
  if (e.getMessage().startsWith("Cannot support given S3 encryption type")) {
    LOG.error("Fix s3.sse-type value; supported: NONE, SSE-S3, SSE-KMS, SSE-C");
  }
}

Prevention

Copy s3.sse-type values verbatim from the Iceberg docs (exact spelling/case)
Pair SSE-C with s3.sse-key and s3.sse-md5; SSE-KMS with s3.sse-key-id
Validate config values in a startup smoke test before launching clusters

When it happens

Trigger: Setting s3.sse-type to a typo or unsupported string (e.g. 'sse_kms', 'KMS ', 'aws:kms') that doesn't match the S3FileIOProperties.Encryption enum constants.

Common situations: Copying config from older docs or other tools using different naming; case/underscore mistakes; newer encryption modes not yet supported by the installed Iceberg version.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/1931b87b7cdc9389. Report an issue: GitHub.