{"record":{"id":"44d8d8dbda69a4e0","repo":"apache/flink","slug":"unknown-encryption-type-supported-values-non","errorCode":null,"errorMessage":"Unknown encryption type: {}. Supported values: none, sse-s3, sse-kms","messagePattern":"Unknown encryption type: (.+?)\\. Supported values: none, sse-s3, sse-kms","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3EncryptionConfig.java","lineNumber":149,"sourceCode":"            @Nullable String encryptionTypeStr,\n            @Nullable String kmsKeyId,\n            Map<String, String> encryptionContext) {\n        if (StringUtils.isNullOrWhitespaceOnly(encryptionTypeStr)\n                || \"none\".equalsIgnoreCase(encryptionTypeStr)) {\n            return none();\n        }\n\n        String normalizedType = encryptionTypeStr.toLowerCase(Locale.ROOT);\n\n        switch (normalizedType) {\n            case \"sse-s3\":\n            case \"aes256\":\n                return sseS3();\n            case \"sse-kms\":\n            case \"aws:kms\":\n                return sseKms(kmsKeyId, encryptionContext);\n            default:\n                throw new IllegalArgumentException(\n                        \"Unknown encryption type: \"\n                                + encryptionTypeStr\n                                + \". Supported values: none, sse-s3, sse-kms\");\n        }\n    }\n\n    public EncryptionType getEncryptionType() {\n        return encryptionType;\n    }\n\n    @Nullable\n    public String getKmsKeyId() {\n        return kmsKeyId;\n    }\n\n    /**\n     * Gets the encryption context for SSE-KMS.\n     *","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-filesystems/flink-s3-fs-native/src/main/java/org/apache/flink/fs/s3native/S3EncryptionConfig.java#L131-L167","documentation":"S3EncryptionConfig.fromConfig normalizes fs.s3.encryption.type (lowercased) and maps sse-s3/aes256 to SSE-S3 and sse-kms/aws:kms to SSE-KMS; 'none'/absent disables encryption. Any other value falls into the default branch and throws this IllegalArgumentException listing the supported set. Note the accepted aliases: aes256 and aws:kms are legacy spellings carried over from the presto/hadoop filesystem options.","triggerScenarios":"Setting fs.s3.encryption.type (s3.encryption.type) to values like SSE-S3 with different casing is fine (lowercased) but 'SSE', 'sse-c', 'kms', 'AES-128', 'aws:kms:dsse' or a typo like 'sse-km' hit the default branch. Also copying values valid for other filesystems (e.g. 'SSE-C', 'aws:kms:dsse' DSSE) that this module does not support.","commonSituations":"Config migration from hadoop-aws (which accepts SSE-KMS with different casing/keys); enabling SSE-C (customer keys) which is not implemented; trailing whitespace/quotes in YAML producing 'sse-kms ' handled by trim+lowercase but embedded values like 'sse_kms' (underscore) failing; copy-paste of 'aws:kms' is fine but 'AWS:KMS:' typo fails.","solutions":["Set fs.s3.encryption.type to one of: none, sse-s3 (or aes256), sse-kms (or aws:kms).","For SSE-KMS also set fs.s3.kms-key.id (and optionally encryption context) — a valid type with missing key gives a different, clearer error.","If you need SSE-C or DSSE-KMS, this module does not support them; use SSE-KMS with a KMS key policy instead or contribute the feature.","Check for YAML quoting/casing typos: value is trimmed and lowercased, so only genuine spelling/alias mistakes reach the error."],"exampleFix":"# before (flink-conf.yaml)\nfs.s3.encryption.type: SSE\n\n# after\nfs.s3.encryption.type: sse-kms\nfs.s3.kms-key.id: arn:aws:kms:us-east-1:123456789012:key/abcd-1234","handlingStrategy":"validation","validationCode":"static final Set<String> VALID = Set.of(\"none\", \"sse-s3\", \"aes256\", \"sse-kms\", \"aws:kms\");\nString t = conf.getOptional(S3_OPTIONS.encryptionType).orElse(\"none\").trim().toLowerCase(Locale.ROOT);\nif (!VALID.contains(t)) throw new IllegalArgumentException(\"fs.s3.encryption.type must be one of \" + VALID + \" but was '\" + t + \"'\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin the exact spelling sse-s3 / sse-kms / none in config templates and document the aliases rather than relying on them.","Remember SSE-C and DSSE are not supported by this module; do not carry those values over from other systems' configs.","When encryption is enabled, set fs.s3.kms-key.id at the same time and test one write before rollout."],"tags":["configuration","encryption","sse","kms","s3","flink"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}