{"record":{"id":"62931904e11b0e51","repo":"prestodb/presto","slug":"unable-to-load-or-create-s3-encryption-materials-p","errorCode":null,"errorMessage":"Unable to load or create S3 encryption materials provider: ${empClassName}","messagePattern":"Unable to load or create S3 encryption materials provider: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/s3/PrestoS3FileSystem.java","lineNumber":847,"sourceCode":"\n        String empClassName = hadoopConfig.get(S3_ENCRYPTION_MATERIALS_PROVIDER);\n        if (empClassName == null) {\n            return Optional.empty();\n        }\n\n        try {\n            Object instance = Class.forName(empClassName).getConstructor().newInstance();\n            if (!(instance instanceof EncryptionMaterialsProvider)) {\n                throw new RuntimeException(\"Invalid encryption materials provider class: \" + instance.getClass().getName());\n            }\n            EncryptionMaterialsProvider emp = (EncryptionMaterialsProvider) instance;\n            if (emp instanceof Configurable) {\n                ((Configurable) emp).setConf(hadoopConfig);\n            }\n            return Optional.of(emp);\n        }\n        catch (ReflectiveOperationException e) {\n            throw new RuntimeException(\"Unable to load or create S3 encryption materials provider: \" + empClassName, e);\n        }\n    }\n\n    private AWSCredentialsProvider createAwsCredentialsProvider(URI uri, Configuration conf)\n    {\n        Optional<AWSCredentials> credentials = getAwsCredentials(uri, conf);\n        if (credentials.isPresent()) {\n            return new AWSStaticCredentialsProvider(credentials.get());\n        }\n\n        if (useInstanceCredentials) {\n            return InstanceProfileCredentialsProvider.getInstance();\n        }\n\n        if (!isNullOrEmpty(s3IamRole)) {\n            if (webIdentityEnabled) {\n                log.debug(\"Using Web Identity Token Credentials Provider.\");\n                WebIdentityTokenCredentialsProvider.Builder providerBuilder = WebIdentityTokenCredentialsProvider.builder()","sourceCodeStart":829,"sourceCodeEnd":865,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/s3/PrestoS3FileSystem.java#L829-L865","documentation":"If instantiating the configured encryption materials provider fails for any reflective reason (class not found, no no-arg constructor, constructor threw), the connector wraps the ReflectiveOperationException in a RuntimeException with this message. The ${empClassName} in the source message is actually the literal concatenation with the configured class name.","triggerScenarios":"hive.s3.encryption-materials-provider names a class not on the classpath; class lacks a public no-arg constructor; the class's constructor throws (e.g. missing KMS credentials); class not found because the plugin jar isn't deployed.","commonSituations":"Custom encryption plugin jar missing from the plugin directory; typo in fully-qualified class name; class depends on SDK version not present; constructor reads config that is absent and throws.","solutions":["Verify the fully-qualified class name spelling in the config.","Deploy the provider's jar to the Presto Hive S3 plugin directory and restart.","Add a public no-arg constructor to the provider class.","Fix exceptions thrown inside the constructor (check logs for the cause chain)."],"exampleFix":"// before\nhive.s3.encryption-materials-provider=com.example.WrongeNameProvider\n// after\nhive.s3.encryption-materials-provider=com.example.CorrectKmsMaterialsProvider","handlingStrategy":"try-catch","validationCode":"String cls = conf.get(\"hive.s3.encryption-materials-provider\");\nif (cls != null) {\n    try { Class.forName(cls).getDeclaredConstructor(); }\n    catch (ClassNotFoundException e) { throw new IllegalStateException(\"provider not on classpath: \" + cls); }\n}","typeGuard":"null","tryCatchPattern":"try {\n    createEncryptionMaterialsProvider(...);\n} catch (RuntimeException e) {\n    if (e.getMessage().startsWith(\"Unable to load or create S3 encryption materials provider\")) {\n        LOG.error(\"check class name, plugin jar deployment, and constructor\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Deploy the provider jar into the Hive S3 plugin directory and restart.","Double-check the fully-qualified class name spelling.","Ensure a public no-arg constructor exists.","Investigate the cause chain for constructor-time failures (missing KMS creds/config)."],"tags":["s3","encryption","classpath","reflection","configuration"],"backgroundTag":"class-not-found","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}