{"record":{"id":"5eb025d65b9132cd","repo":"prestodb/presto","slug":"hive-unsupported-encryption-operation","errorCode":"HIVE_UNSUPPORTED_ENCRYPTION_OPERATION","errorMessage":"Creating an encrypted table without partitions is not supported. Use CREATE TABLE AS SELECT to create an encrypted table without partitions","messagePattern":"Creating an encrypted table without partitions is not supported\\. Use CREATE TABLE AS SELECT to create an encrypted table without partitions","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/HiveMetadata.java","lineNumber":1084,"sourceCode":"    {\n        SchemaTableName schemaTableName = tableMetadata.getTable();\n        String schemaName = schemaTableName.getSchemaName();\n        String tableName = schemaTableName.getTableName();\n        List<String> partitionedBy = getPartitionedBy(tableMetadata.getProperties());\n        Optional<HiveBucketProperty> bucketProperty = getBucketProperty(tableMetadata.getProperties());\n\n        if (bucketProperty.isPresent() && getAvroSchemaUrl(tableMetadata.getProperties()) != null) {\n            throw new PrestoException(NOT_SUPPORTED, \"Bucketing columns not supported when Avro schema url is set\");\n        }\n\n        List<HiveColumnHandle> columnHandles = getColumnHandles(tableMetadata, ImmutableSet.copyOf(partitionedBy), typeTranslator);\n        HiveStorageFormat hiveStorageFormat = getHiveStorageFormat(tableMetadata.getProperties());\n        List<SortingColumn> preferredOrderingColumns = getPreferredOrderingColumns(tableMetadata.getProperties());\n\n        Optional<TableEncryptionProperties> tableEncryptionProperties = getTableEncryptionPropertiesFromTableProperties(tableMetadata, hiveStorageFormat, partitionedBy);\n\n        if (tableEncryptionProperties.isPresent() && partitionedBy.isEmpty()) {\n            throw new PrestoException(HIVE_UNSUPPORTED_ENCRYPTION_OPERATION, \"Creating an encrypted table without partitions is not supported. Use CREATE TABLE AS SELECT to \" +\n                    \"create an encrypted table without partitions\");\n        }\n\n        validateColumns(hiveStorageFormat, columnHandles);\n\n        MetastoreContext metastoreContext = getMetastoreContext(session);\n\n        Map<String, HiveColumnHandle> columnHandlesByName = Maps.uniqueIndex(columnHandles, HiveColumnHandle::getName);\n        List<Column> partitionColumns = partitionedBy.stream()\n                .map(columnHandlesByName::get)\n                .map(columnHandle -> columnHandleToColumn(metastoreContext, columnHandle))\n                .collect(toList());\n        checkPartitionTypesSupported(partitionColumns);\n\n        Path targetPath;\n        if (tableType.equals(EXTERNAL_TABLE)) {\n            if (!createsOfNonManagedTablesEnabled) {\n                throw new PrestoException(NOT_SUPPORTED, \"Cannot create non-managed Hive table\");","sourceCodeStart":1066,"sourceCodeEnd":1102,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/HiveMetadata.java#L1066-L1102","documentation":"Presto only supports encrypted Hive tables when they are partitioned; encryption metadata is applied per-partition. When getTableEncryptionPropertiesFromTableProperties returns encryption properties and the target table has no partitioned_by columns, CreateTable throws HIVE_UNSUPPORTED_ENCRYPTION_OPERATION and directs users to CTAS.","triggerScenarios":"CREATE TABLE ... WITH (encrypted=..., encryption_algorithm=..., encryption_key_provider=...) without a partitioned_by property — i.e. an unpartitioned encrypted table created via CREATE TABLE (not CREATE TABLE AS SELECT).","commonSituations":"Following Hive encryption examples without partitioning; converting existing encrypted Hive scripts to Presto DDL; misunderstanding that CTAS is the required path for unpartitioned encrypted tables.","solutions":["Use CREATE TABLE AS SELECT (CTAS) instead of CREATE TABLE ... AS the message suggests, since unpartitioned encrypted tables are only supported that way","Add partitioned_by columns to the CREATE TABLE statement so the table is partitioned","Drop the encryption properties if encryption is not actually required"],"exampleFix":"// before\nCREATE TABLE t WITH (format='ORC', encrypted=true, encryption_algorithm='AES_GCM_CTR', encryption_key_provider='...') AS SELECT ...\n// after\nCREATE TABLE t WITH (format='ORC', partitioned_by=ARRAY['ds']) AS SELECT *, '2026-09-04' AS ds FROM src -- or use plain CTAS without partition clause\nCREATE TABLE t WITH (format='ORC') AS SELECT * FROM src;","handlingStrategy":"validation","validationCode":"// before CREATE TABLE with encryption\nboolean encrypted = properties.containsKey(\"encrypted\") || properties.containsKey(\"encryption_key_provider\");\nList<String> partitionedBy = (List<String>) properties.getOrDefault(\"partitioned_by\", List.of());\nif (encrypted && partitionedBy.isEmpty()) {\n    throw new IllegalArgumentException(\"Unpartitioned encrypted tables require CREATE TABLE AS SELECT\");\n}","typeGuard":"boolean isUnpartitionedEncryptedCreate(Map<String,Object> properties) {\n    List<?> partitionedBy = (List<?>) properties.get(\"partitioned_by\");\n    return properties.containsKey(\"encrypted\")\n        && (partitionedBy == null || partitionedBy.isEmpty());\n}","tryCatchPattern":"try {\n    connector.createTable(session, columns, properties);\n} catch (PrestoException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"encrypted table without partitions\")) {\n        // fall back to CTAS: connector.createTableAsSelect with encryption properties\n    } else { throw e; }\n}","preventionTips":["Always use CTAS when creating unpartitioned encrypted tables","Add partitioned_by columns if a plain CREATE TABLE with encryption is needed","Keep encryption properties out of DDL templates unless encryption is truly required"],"tags":["hive","encryption","ctas","not-supported"],"backgroundTag":"unsupported-feature-combination","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}