apache/iceberg · error · RuntimeException

Creating BigQuery client failed due to a security issue

Error message

Creating BigQuery client failed due to a security issue

What it means

If constructing the BigQuery metastore client throws GeneralSecurityException (typically credential/key handling problems), initialize() wraps it in a RuntimeException stating the client creation failed due to a security issue.

Source

Thrown at bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryMetastoreCatalog.java:92

  public BigQueryMetastoreCatalog() {}

  @Override
  public void initialize(String name, Map<String, String> properties) {

    BigQueryProperties bigQueryProperties = new BigQueryProperties(properties);

    this.projectId = bigQueryProperties.projectId();
    this.projectLocation = bigQueryProperties.location();
    this.listAllTables = bigQueryProperties.listAllTables();

    BigQueryOptions bigQueryOptions = bigQueryProperties.metastoreOptions();

    try {
      client = new BigQueryMetastoreClientImpl(bigQueryOptions);
    } catch (IOException e) {
      throw new UncheckedIOException("Creating BigQuery client failed", e);
    } catch (GeneralSecurityException e) {
      throw new RuntimeException("Creating BigQuery client failed due to a security issue", e);
    }

    initialize(name, properties, projectId, projectLocation, client);
  }

  @VisibleForTesting
  void initialize(
      String name,
      Map<String, String> properties,
      String initialProjectId,
      String initialLocation,
      BigQueryMetastoreClient bigQueryMetaStoreClient) {
    Preconditions.checkArgument(bigQueryMetaStoreClient != null, "Invalid BigQuery client: null");
    this.catalogName = name;
    this.catalogProperties = ImmutableMap.copyOf(properties);
    this.projectId = initialProjectId;
    this.projectLocation = initialLocation;
    this.client = bigQueryMetaStoreClient;

View on GitHub (pinned to 86d9c8fc54)

Solutions

Inspect the wrapped GeneralSecurityException cause for the credential problem.
Regenerate the service account key and point the config at the new valid JSON key file.
Verify the credential file is a service account key (not an OAuth client secret) and is valid JSON.
Ensure required scopes and enabled APIs (BigQuery API) on the project.

Defensive patterns

Strategy: try-catch

Validate before calling

// verify credentials load before creating the catalog client
GoogleCredentials credentials = ServiceAccountCredentials.fromStream(new FileInputStream(keyPath));

Try / catch

try { catalog.initialize(name, props); } catch (RuntimeException e) { if (e.getMessage().contains("security issue")) { log.error("Check Google credentials: {}", e.getCause()); } throw e; }

Prevention

Use a valid, non-expired service account JSON key (not an OAuth client secret).
Load and validate credentials with the Google auth library before catalog init.
Ensure the BigQuery API is enabled and the key has the right roles on the project.

When it happens

Trigger: new BigQueryMetastoreClientImpl(bigQueryOptions) throws GeneralSecurityException — usually invalid, malformed, or unloadable Google credentials (bad service account key, wrong scope setup).

Common situations: Corrupted or wrong-format service account JSON key; using an OAuth client secret where a service account key is expected; missing/incorrect scopes; expired or revoked key.

Related errors

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/fabdf0861658ba85. Report an issue: GitHub.