apache/iceberg · error · IllegalStateException

Unsupported KMS type: ${kmsType}

Error message

Unsupported KMS type: ${kmsType}

What it means

EncryptionUtil.createKmsClient switches on the encryption.kms.type property (aws/azure/gcp) and throws IllegalStateException for any other value, because no built-in KMS client implementation is registered for it.

Source

Thrown at core/src/main/java/org/apache/iceberg/encryption/EncryptionUtil.java:66

    String kmsType = catalogProperties.get(CatalogProperties.ENCRYPTION_KMS_TYPE);
    String kmsImpl = catalogProperties.get(CatalogProperties.ENCRYPTION_KMS_IMPL);

    Preconditions.checkArgument(
        kmsType == null || kmsImpl == null,
        "Cannot set both KMS type (%s) and KMS impl (%s)",
        kmsType,
        kmsImpl);

    if (kmsType != null) {
      kmsImpl =
          switch (kmsType.toLowerCase(Locale.ROOT)) {
            case CatalogProperties.ENCRYPTION_KMS_TYPE_AWS ->
                CatalogProperties.ENCRYPTION_KMS_IMPL_AWS;
            case CatalogProperties.ENCRYPTION_KMS_TYPE_AZURE ->
                CatalogProperties.ENCRYPTION_KMS_IMPL_AZURE;
            case CatalogProperties.ENCRYPTION_KMS_TYPE_GCP ->
                CatalogProperties.ENCRYPTION_KMS_IMPL_GCP;
            default -> throw new IllegalStateException("Unsupported KMS type: " + kmsType);
          };
    }

    KeyManagementClient kmsClient;
    DynConstructors.Ctor<KeyManagementClient> ctor;
    try {
      ctor =
          DynConstructors.builder(KeyManagementClient.class)
              .loader(EncryptionUtil.class.getClassLoader())
              .impl(kmsImpl)
              .buildChecked();
    } catch (NoSuchMethodException e) {
      throw new IllegalArgumentException(
          String.format(
              "Cannot initialize KeyManagementClient, missing no-arg constructor for class %s",
              kmsImpl),
          e);
    }

View on GitHub (pinned to 86d9c8fc54)

Solutions

1. Set encryption.kms.type to exactly one of: aws, azure, gcp
2. Check for typos, whitespace, or case mismatches in the property value
3. If you need another KMS, implement/configure a KeyManagementClient directly instead of relying on the built-in types

Example fix

// before
table.properties().put("encryption.kms.type", "s3-kms");
// after
table.properties().put("encryption.kms.type", "aws");

String kmsType = properties.get("encryption.kms.type");
if (kmsType != null && !Set.of("aws", "azure", "gcp").contains(kmsType.toLowerCase(Locale.ROOT))) {
  throw new IllegalArgumentException("encryption.kms.type must be aws|azure|gcp, got: " + kmsType);
}

try {
  kms = EncryptionUtil.createKmsClient(config);
} catch (IllegalStateException e) {
  if (e.getMessage().startsWith("Unsupported KMS type")) {
    throw new ConfigException("Fix encryption.kms.type; supported: aws, azure, gcp", e);
  }
  throw e;
}

When it happens

Trigger: Setting table/catalog property encryption.kms.type to a value outside {aws, azure, gcp} (typo like ' Aws', 's3', or an unsupported vendor) and then triggering client creation.

Common situations: Typo or wrong casing in the kms.type config; copying a config from a system using a different KMS integration; expecting a generic/plug-in KMS type that Iceberg doesn't define.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Cannot support given S3 encryption type:
• Cannot initialize KeyManagementClient, missing no-arg constr
• Cannot initialize kms client, ${kmsImpl} does not implement
• Invalid distribution mode: %s
• Invalid file format: %s

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/734563fdede2dc4a. Report an issue: GitHub.