apache/iceberg · error · UnsupportedOperationException

ORC does not support file encryption keys

Error message

ORC does not support file encryption keys

What it means

ORC does not implement Iceberg's file-level encryption (file encryption keys). The ORC ModelWriteBuilder.withFileEncryptionKey override always throws UnsupportedOperationException to make this limitation explicit rather than silently writing unencrypted data.

Solutions

1. Do not configure file encryption keys when writing ORC files
2. Use Parquet for tables that require Iceberg file encryption
3. Strip encryption settings (withFileEncryptionKey/withAADPrefix) from the ORC write path

Example fix

// before
writeBuilder.withFileEncryptionKey(key).withAADPrefix(aad); // throws for ORC
// after
if ("parquet".equals(fileFormat)) { writeBuilder.withFileEncryptionKey(key); } // skip for ORC

if (format == FileFormat.ORC && encryptionKey != null) {
  throw new IllegalArgumentException("File encryption keys are not supported for ORC");
}

boolean encryptionSupported(FileFormat f) { return f == FileFormat.PARQUET; }

try {
  builder.withFileEncryptionKey(key);
} catch (UnsupportedOperationException e) {
  if (e.getMessage().contains("file encryption keys")) {
    log.warn("ORC does not support encryption; writing without key");
  } else throw e;
}

When it happens

Trigger: Calling withFileEncryptionKey(...) (directly or via a generic write path that configures encryption) when writing ORC files, e.g. tables configured for encryption key handling with format=orc.

Common situations: Shared write pipelines that set encryption keys for all formats; switching a table's file format from Parquet (which supports encryption) to ORC without removing encryption config.

Related errors

• ORC does not support AAD prefix
• Position delete writer does not support row data
• Avro does not support AAD prefix
• Avro does not support file encryption keys
• Batch reading is not supported in non-vectorized reader

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/d810af4c9510da07. Report an issue: GitHub.

Appendix: source

Thrown at orc/src/main/java/org/apache/iceberg/orc/ORCFormatModel.java:159

      return this;
    }

    @Override
    public ModelWriteBuilder<D, S> metricsConfig(MetricsConfig metricsConfig) {
      internal.metricsConfig(metricsConfig);
      return this;
    }

    @Override
    public ModelWriteBuilder<D, S> overwrite() {
      internal.overwrite();
      return this;
    }

    @Override
    public ModelWriteBuilder<D, S> withFileEncryptionKey(ByteBuffer encryptionKey) {
      // ORC doesn't support file encryption
      throw new UnsupportedOperationException("ORC does not support file encryption keys");
    }

    @Override
    public ModelWriteBuilder<D, S> withAADPrefix(ByteBuffer aadPrefix) {
      // ORC doesn't support file encryption
      throw new UnsupportedOperationException("ORC does not support AAD prefix");
    }

    @Override
    public FileAppender<D> build() {
      switch (content) {
        case DATA:
          internal.createContextFunc(ORC.WriteBuilder.Context::dataContext);
          internal.createWriterFunc(
              (icebergSchema, typeDescription) ->
                  writerFunction.write(icebergSchema, typeDescription, engineSchema));
          break;
        case EQUALITY_DELETES:

View on GitHub (pinned to 86d9c8fc54)