{"record":{"id":"734563fdede2dc4a","repo":"apache/iceberg","slug":"unsupported-kms-type-kmstype","errorCode":null,"errorMessage":"Unsupported KMS type: ${kmsType}","messagePattern":"Unsupported KMS type: (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/apache/iceberg/encryption/EncryptionUtil.java","lineNumber":66,"sourceCode":"    String kmsType = catalogProperties.get(CatalogProperties.ENCRYPTION_KMS_TYPE);\n    String kmsImpl = catalogProperties.get(CatalogProperties.ENCRYPTION_KMS_IMPL);\n\n    Preconditions.checkArgument(\n        kmsType == null || kmsImpl == null,\n        \"Cannot set both KMS type (%s) and KMS impl (%s)\",\n        kmsType,\n        kmsImpl);\n\n    if (kmsType != null) {\n      kmsImpl =\n          switch (kmsType.toLowerCase(Locale.ROOT)) {\n            case CatalogProperties.ENCRYPTION_KMS_TYPE_AWS ->\n                CatalogProperties.ENCRYPTION_KMS_IMPL_AWS;\n            case CatalogProperties.ENCRYPTION_KMS_TYPE_AZURE ->\n                CatalogProperties.ENCRYPTION_KMS_IMPL_AZURE;\n            case CatalogProperties.ENCRYPTION_KMS_TYPE_GCP ->\n                CatalogProperties.ENCRYPTION_KMS_IMPL_GCP;\n            default -> throw new IllegalStateException(\"Unsupported KMS type: \" + kmsType);\n          };\n    }\n\n    KeyManagementClient kmsClient;\n    DynConstructors.Ctor<KeyManagementClient> ctor;\n    try {\n      ctor =\n          DynConstructors.builder(KeyManagementClient.class)\n              .loader(EncryptionUtil.class.getClassLoader())\n              .impl(kmsImpl)\n              .buildChecked();\n    } catch (NoSuchMethodException e) {\n      throw new IllegalArgumentException(\n          String.format(\n              \"Cannot initialize KeyManagementClient, missing no-arg constructor for class %s\",\n              kmsImpl),\n          e);\n    }","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/core/src/main/java/org/apache/iceberg/encryption/EncryptionUtil.java#L48-L84","documentation":"EncryptionUtil.createKmsClient switches on the encryption.kms.type property (aws/azure/gcp) and throws IllegalStateException for any other value, because no built-in KMS client implementation is registered for it.","triggerScenarios":"Setting table/catalog property encryption.kms.type to a value outside {aws, azure, gcp} (typo like ' Aws', 's3', or an unsupported vendor) and then triggering client creation.","commonSituations":"Typo or wrong casing in the kms.type config; copying a config from a system using a different KMS integration; expecting a generic/plug-in KMS type that Iceberg doesn't define.","solutions":["Set encryption.kms.type to exactly one of: aws, azure, gcp","Check for typos, whitespace, or case mismatches in the property value","If you need another KMS, implement/configure a KeyManagementClient directly instead of relying on the built-in types"],"exampleFix":"// before\ntable.properties().put(\"encryption.kms.type\", \"s3-kms\");\n// after\ntable.properties().put(\"encryption.kms.type\", \"aws\");","handlingStrategy":"validation","validationCode":"String kmsType = properties.get(\"encryption.kms.type\");\nif (kmsType != null && !Set.of(\"aws\", \"azure\", \"gcp\").contains(kmsType.toLowerCase(Locale.ROOT))) {\n  throw new IllegalArgumentException(\"encryption.kms.type must be aws|azure|gcp, got: \" + kmsType);\n}","typeGuard":null,"tryCatchPattern":"try {\n  kms = EncryptionUtil.createKmsClient(config);\n} catch (IllegalStateException e) {\n  if (e.getMessage().startsWith(\"Unsupported KMS type\")) {\n    throw new ConfigException(\"Fix encryption.kms.type; supported: aws, azure, gcp\", e);\n  }\n  throw e;\n}","preventionTips":["Copy kms.type values verbatim from documentation; no whitespace or casing tweaks","Validate catalog/table properties at startup with a whitelist check","Note the switch is case-sensitive per constant definitions — match exactly"],"tags":["configuration","encryption","kms","enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}