{"record":{"id":"8b487a1252898efe","repo":"prestodb/presto","slug":"not-supported-8b487a","errorCode":"NOT_SUPPORTED","errorMessage":"Iceberg table encryption is not supported","messagePattern":"Iceberg table encryption is not supported","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"error","filePath":"presto-iceberg/src/main/java/com/facebook/presto/iceberg/IcebergAbstractMetadata.java","lineNumber":449,"sourceCode":"\n        if (snapshot == null) {\n            // empty table, nothing to validate\n            return;\n        }\n\n        TableMetadata metadata = table.operations().current();\n        if (metadata.formatVersion() < MIN_FORMAT_VERSION_FOR_ROW_LINEAGE) {\n            return;\n        }\n\n        Schema schema = metadata.schemasById().get(snapshot.schemaId());\n        if (schema == null) {\n            schema = metadata.schema();\n        }\n\n        // Reject Iceberg table encryption\n        if (!metadata.encryptionKeys().isEmpty() || snapshot.keyId() != null || metadata.properties().containsKey(\"encryption.key-id\")) {\n            throw new PrestoException(NOT_SUPPORTED, \"Iceberg table encryption is not supported\");\n        }\n    }\n\n    /**\n     * This class implements the default implementation for getTableLayoutForConstraint which will be used in the case of a Java Worker\n     */\n    @Override\n    public ConnectorTableLayoutResult getTableLayoutForConstraint(\n            ConnectorSession session,\n            ConnectorTableHandle table,\n            Constraint<ColumnHandle> constraint,\n            Optional<Set<ColumnHandle>> desiredColumns)\n    {\n        Map<String, IcebergColumnHandle> predicateColumns = constraint.getSummary().getDomains()\n                .map(domains -> domains.keySet().stream()\n                        .map(IcebergColumnHandle.class::cast)\n                        .collect(toImmutableMap(IcebergColumnHandle::getName, Functions.identity())))\n                .orElse(ImmutableMap.of());","sourceCodeStart":431,"sourceCodeEnd":467,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-iceberg/src/main/java/com/facebook/presto/iceberg/IcebergAbstractMetadata.java#L431-L467","documentation":"validateTableForPresto() rejects any Iceberg table using encryption: non-empty metadata.encryptionKeys(), a snapshot keyId, or an 'encryption.key-id' table property. Presto does not support reading encrypted Iceberg tables, so it throws NOT_SUPPORTED during getTableHandle.","triggerScenarios":"Querying (or otherwise resolving a table handle for) an Iceberg table that was written with an encryption-enabled writer — e.g. tables encrypted with format-level encryption keys created by other engines.","commonSituations":"Tables created with Iceberg encryption (key management/KMS integrations) in Spark/Flink then queried from Presto; a stray 'encryption.key-id' property left on the table after encryption was disabled.","solutions":["Rewrite the table unencrypted using the engine that wrote it, then query it from Presto.","Remove the leftover 'encryption.key-id' table property if encryption is genuinely not in use: ALTER TABLE ... SET PROPERTIES / unset via writer engine.","Check snapshots: if a snapshot carries a keyId, roll to a snapshot without encryption or recreate the table from unencrypted data."],"exampleFix":"// before\nproperties.put(\"encryption.key-id\", \"arn:aws:kms:...\");\n// after\nproperties.remove(\"encryption.key-id\"); // or recreate table without encryption","handlingStrategy":"validation","validationCode":"Map<String,String> props = table.properties();\nboolean encrypted = !table.encryptionKeys().isEmpty() || props.containsKey(\"encryption.key-id\");\nif (encrypted) throw new IllegalStateException(\"Table is encrypted; Presto cannot read it\");","typeGuard":null,"tryCatchPattern":"try { resolveTable(...); }\ncatch (PrestoException e) { if (e.getErrorCode() == NOT_SUPPORTED.toErrorCode()) { /* route to engine that supports encryption */ } }","preventionTips":["Keep encrypted Iceberg tables out of Presto-accessible catalogs.","Audit table properties for stray encryption.key-id entries.","Standardize encryption strategy per engine before sharing tables."],"tags":["iceberg","encryption","not-supported","compatibility"],"backgroundTag":"feature-not-supported","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}