{"record":{"id":"1a00ab8afd8072a9","repo":"apache/hadoop","slug":"aes256-is-enabled-but-an-encryption-key-was-set-in","errorCode":null,"errorMessage":"AES256 is enabled but an encryption key was set in fs.s3a.encryption.key ({diagnostics})","messagePattern":"AES256 is enabled but an encryption key was set in fs\\.s3a\\.encryption\\.key \\((.+?)\\)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java","lineNumber":1518,"sourceCode":"    // look up the encryption key\n    String encryptionKey = getS3EncryptionKey(bucket, conf,\n        encryptionMethod.requiresSecret());\n    int encryptionKeyLen =\n        StringUtils.isBlank(encryptionKey) ? 0 : encryptionKey.length();\n    String diagnostics = passwordDiagnostics(encryptionKey, \"key\");\n    String encryptionContext = S3AEncryption.getS3EncryptionContextBase64Encoded(bucket, conf,\n        encryptionMethod.requiresSecret());\n    switch (encryptionMethod) {\n    case SSE_C:\n      LOG.debug(\"Using SSE-C with {}\", diagnostics);\n      if (encryptionKeyLen == 0) {\n        throw new IOException(SSE_C_NO_KEY_ERROR);\n      }\n      break;\n\n    case SSE_S3:\n      if (encryptionKeyLen != 0) {\n        throw new IOException(SSE_S3_WITH_KEY_ERROR\n            + \" (\" + diagnostics + \")\");\n      }\n      break;\n\n    case SSE_KMS:\n      LOG.debug(\"Using SSE-KMS with {}\",\n          diagnostics);\n      break;\n\n    case CSE_KMS:\n      LOG.debug(\"Using CSE-KMS with {}\",\n          diagnostics);\n      break;\n\n    case DSSE_KMS:\n      LOG.debug(\"Using DSSE-KMS with {}\",\n          diagnostics);\n      break;","sourceCodeStart":1500,"sourceCodeEnd":1536,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java#L1500-L1536","documentation":"The mirror image of the SSE-C error: fs.s3a.encryption.algorithm is SSE-S3 ('AES256', S3-managed keys) but fs.s3a.encryption.key is set. S3-managed encryption never takes a customer key, so S3A rejects the combination at filesystem initialization, embedding the password diagnostics of the stray key in the message.","triggerScenarios":"Switching a bucket from SSE-C/SSE-KMS to AES256 while leaving fs.s3a.encryption.key in place; global templates that always define the key; per-bucket encryption.key overrides leaking into a bucket configured for SSE-S3.","commonSituations":"Changing encryption strategy between environments (test on SSE-S3, prod on SSE-C) while copying properties; keys left behind after a migration; bucket-scoped overrides applied more widely than intended.","solutions":["Remove fs.s3a.encryption.key (and fs.s3a.bucket.<bucket>.encryption.key) when using SSE-S3/AES256","If customer-provided keys were intended, set fs.s3a.encryption.algorithm=SSE-C instead","Scan configs and credential stores for stray encryption.key entries after encryption migrations","Redeploy and verify with a small read/write against the bucket"],"exampleFix":"<!-- before: S3-managed encryption plus a stray customer key -->\n<property><name>fs.s3a.encryption.algorithm</name><value>AES256</value></property>\n<property><name>fs.s3a.encryption.key</name><value>some-key</value></property>\n\n<!-- after: AES256 takes no customer key -->\n<property><name>fs.s3a.encryption.algorithm</name><value>AES256</value></property>","handlingStrategy":"validation","validationCode":"String alg = conf.getTrimmed(\"fs.s3a.encryption.algorithm\", \"\");\nchar[] key = conf.getPassword(\"fs.s3a.encryption.key\");\nboolean keyPresent = key != null && !new String(key).trim().isEmpty();\nif ((\"AES256\".equalsIgnoreCase(alg) || \"SSE-S3\".equalsIgnoreCase(alg)) && keyPresent) {\n  throw new IOException(\"fs.s3a.encryption.key must be unset for SSE-S3/AES256\");\n}","typeGuard":null,"tryCatchPattern":"catch IOException containing 'AES256 is enabled but an encryption key was set' at fs init; remove the stray key - not retryable","preventionTips":["Model encryption algorithm and key as mutually exclusive options in templates","After changing the encryption algorithm, grep configs and credential stores for leftover keys","Apply per-bucket encryption overrides deliberately and review them"],"tags":["s3a","hadoop-aws","encryption","sse-s3","configuration"],"backgroundTag":"invalid-configuration","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}