apache/iceberg · error · UnsupportedOperationException

Key generation is not supported in this KmsClient

Error message

Key generation is not supported in this KmsClient

What it means

KeyManagementClient.generateKey is a default method that throws UnsupportedOperationException. Only KMS clients that natively support creating data keys override it; the default implementation signals that this KMS backend cannot generate keys and callers must supply existing wrapped keys instead.

Source

Thrown at core/src/main/java/org/apache/iceberg/encryption/KeyManagementClient.java:61

   * @return true if KMS server supports key generation and KeyManagementClient implementation is
   *     interested to leverage this capability. Otherwise, return false - Iceberg will then
   *     generate secret keys locally (using the SecureRandom mechanism) and call {@link
   *     #wrapKey(ByteBuffer, String)} to wrap them in KMS.
   */
  default boolean supportsKeyGeneration() {
    return false;
  }

  /**
   * Generate a new secret key in the KMS server, and wrap it using a wrapping/master key which is
   * stored in KMS and referenced by an ID. This method will be called only if supportsKeyGeneration
   * returns true.
   *
   * @param wrappingKeyId a key ID that represents a wrapping key stored in KMS
   * @return key in two forms: raw, and wrapped with the given wrappingKeyId
   */
  default KeyGenerationResult generateKey(String wrappingKeyId) {
    throw new UnsupportedOperationException("Key generation is not supported in this KmsClient");
  }

  /**
   * Unwrap a secret key, using a wrapping/master key which is stored in KMS and referenced by an
   * ID.
   *
   * @param wrappedKey wrapped key material (encrypted key and optional KMS metadata, returned by
   *     the wrapKey method)
   * @param wrappingKeyId a key ID that represents a wrapping key stored in KMS
   * @return raw key bytes
   */
  ByteBuffer unwrapKey(ByteBuffer wrappedKey, String wrappingKeyId);

  /**
   * Initialize the KMS client with given properties.
   *
   * @param properties kms client properties
   */

View on GitHub (pinned to 86d9c8fc54)

Solutions

1. Implement generateKey in your KeyManagementClient to create and wrap a new data key in your KMS
2. Switch to a KMS client implementation whose backend supports key generation (e.g. AWS KMS)
3. Rework the workflow to supply pre-generated wrapped keys instead of calling generateKey

Example fix

// before
client.generateKey(wrappingKeyId); // UnsupportedOperationException
// after
if (client.supportsKeyGeneration()) { /* or feature-detect per impl docs */ }
KeyGenerationResult result = keyGenerationCapableClient.generateKey(wrappingKeyId);

// feature-detect per implementation docs or capabilities API if available

boolean supportsKeyGen(KeyManagementClient c) { return !(c.getClass().getPackage().getName().contains("basic")); } // per-impl knowledge

try { return client.generateKey(wrappingKeyId); }
catch (UnsupportedOperationException e) { return fallbackWrap(existingKey, wrappingKeyId); }

When it happens

Trigger: Calling generateKey(wrappingKeyId) on a KeyManagementClient implementation (e.g. a basic KmsClient adapter) that did not override generateKey, typically when creating new encrypted tables with key generation requested.

Common situations: Using a custom or third-party KMS client that only supports wrap/unwrap; running envelope encryption flows that require on-demand key creation against a KMS lacking that capability.

Related errors

• Key generation is not supported in this KmsClient
• Unsupported KMS type: ${kmsType}
• Cannot initialize KeyManagementClient, missing no-arg constr
• Cannot initialize kms client, ${kmsImpl} does not implement
• ${this.getClass().getName()} doesn't implement fileLength

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/e21bbc8edfac872d. Report an issue: GitHub.