{"record":{"id":"1931b87b7cdc9389","repo":"apache/iceberg","slug":"cannot-support-given-s3-encryption-type","errorCode":null,"errorMessage":"Cannot support given S3 encryption type: ","messagePattern":"Cannot support given S3 encryption type: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"aws/src/main/java/org/apache/iceberg/aws/s3/S3RequestUtil.java","lineNumber":131,"sourceCode":"\n      case S3FileIOProperties.DSSE_TYPE_KMS:\n        encryptionSetter.apply(ServerSideEncryption.AWS_KMS_DSSE);\n        kmsKeySetter.apply(s3FileIOProperties.sseKey());\n        break;\n\n      case S3FileIOProperties.SSE_TYPE_S3:\n        encryptionSetter.apply(ServerSideEncryption.AES256);\n        break;\n\n      case S3FileIOProperties.SSE_TYPE_CUSTOM:\n        // setters for SSE-C exist for all request builders, no need to check null\n        customAlgorithmSetter.apply(ServerSideEncryption.AES256.name());\n        customKeySetter.apply(s3FileIOProperties.sseKey());\n        customMd5Setter.apply(s3FileIOProperties.sseMd5());\n        break;\n\n      default:\n        throw new IllegalArgumentException(\n            \"Cannot support given S3 encryption type: \" + s3FileIOProperties.sseType());\n    }\n  }\n\n  static void configurePermission(\n      S3FileIOProperties s3FileIOProperties, PutObjectRequest.Builder requestBuilder) {\n    configurePermission(s3FileIOProperties, requestBuilder::acl);\n  }\n\n  static void configurePermission(\n      S3FileIOProperties s3FileIOProperties, CreateMultipartUploadRequest.Builder requestBuilder) {\n    configurePermission(s3FileIOProperties, requestBuilder::acl);\n  }\n\n  @SuppressWarnings(\"ReturnValueIgnored\")\n  static void configurePermission(\n      S3FileIOProperties s3FileIOProperties,\n      Function<ObjectCannedACL, S3Request.Builder> aclSetter) {","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/aws/src/main/java/org/apache/iceberg/aws/s3/S3RequestUtil.java#L113-L149","documentation":"S3RequestUtil.configureEncryption() switches over the configured server-side encryption type and throws IllegalArgumentException in the default branch when the value is not one of NONE/SSE-S3/SSE-KMS/SSE-C. The s3.sse-type property holds an unknown value.","triggerScenarios":"Setting s3.sse-type to a typo or unsupported string (e.g. 'sse_kms', 'KMS ', 'aws:kms') that doesn't match the S3FileIOProperties.Encryption enum constants.","commonSituations":"Copying config from older docs or other tools using different naming; case/underscore mistakes; newer encryption modes not yet supported by the installed Iceberg version.","solutions":["Set s3.sse-type to exactly one of the supported values (e.g. SSE-S3, SSE-KMS, SSE-C, NONE) as spelled in the docs.","Use s3.sse-key/s3.sse-md5 together with SSE-C; s3.sse-key-id for SSE-KMS.","Upgrade Iceberg if you need an encryption type added in a newer release.","Omit s3.sse-type entirely to use default (no explicit) encryption."],"exampleFix":"// before\nprops.put(\"s3.sse-type\", \"sse_kms\");\n// after\nprops.put(\"s3.sse-type\", \"SSE-KMS\");\nprops.put(\"s3.sse-key-id\", \"arn:aws:kms:us-east-1:123:key/abc\");","handlingStrategy":"validation","validationCode":"// Java\nString sse = props.getProperty(\"s3.sse-type\");\nSet<String> valid = Set.of(\"NONE\", \"SSE-S3\", \"SSE-KMS\", \"SSE-C\");\nif (sse != null && !valid.contains(sse)) {\n  throw new IllegalArgumentException(\"Invalid s3.sse-type: \" + sse);\n}","typeGuard":null,"tryCatchPattern":"// Java\ntry {\n  io.newOutputFile(loc).createOrOverwrite();\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().startsWith(\"Cannot support given S3 encryption type\")) {\n    LOG.error(\"Fix s3.sse-type value; supported: NONE, SSE-S3, SSE-KMS, SSE-C\");\n  }\n}","preventionTips":["Copy s3.sse-type values verbatim from the Iceberg docs (exact spelling/case)","Pair SSE-C with s3.sse-key and s3.sse-md5; SSE-KMS with s3.sse-key-id","Validate config values in a startup smoke test before launching clusters"],"tags":["s3","encryption","configuration","enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}