{"record":{"id":"9e96d7448b050152","repo":"apache/hadoop","slug":"invalid-client-side-encryption-algorithm-only-cse","errorCode":null,"errorMessage":"Invalid client side encryption algorithm. Only CSE-KMS and CSE-CUSTOM are supported","messagePattern":"Invalid client side encryption algorithm\\. Only CSE-KMS and CSE-CUSTOM are supported","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/impl/CSEUtils.java","lineNumber":194,"sourceCode":"    case CSE_KMS:\n      String kmsKeyId = getS3EncryptionKey(bucket, conf, true);\n      Preconditions.checkArgument(kmsKeyId != null && !kmsKeyId.isEmpty(),\n          \"KMS keyId cannot be null or empty\");\n      return new CSEMaterials()\n          .withCSEKeyType(CSEMaterials.CSEKeyType.KMS)\n          .withConf(conf)\n          .withKmsKeyId(kmsKeyId);\n    case CSE_CUSTOM:\n      String customCryptoClassName = conf.getTrimmed(S3_ENCRYPTION_CSE_CUSTOM_KEYRING_CLASS_NAME);\n      Preconditions.checkArgument(customCryptoClassName != null &&\n              !customCryptoClassName.isEmpty(),\n          \"CSE custom cryptographic class name cannot be null or empty\");\n      return new CSEMaterials()\n          .withCSEKeyType(CSEMaterials.CSEKeyType.CUSTOM)\n          .withConf(conf)\n          .withCustomCryptographicClassName(customCryptoClassName);\n    default:\n      throw new IllegalArgumentException(\"Invalid client side encryption algorithm.\"\n          + \" Only CSE-KMS and CSE-CUSTOM are supported\");\n    }\n  }\n}\n","sourceCodeStart":176,"sourceCodeEnd":199,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/impl/CSEUtils.java#L176-L199","documentation":"IllegalArgumentException from CSEUtils.getClientSideEncryptionMaterials' default branch: the S3AEncryptionMethods value passed in is neither CSE_KMS nor CSE_CUSTOM. The switch constructs CSEMaterials for exactly those two client-side-encryption modes (CSE_KMS additionally requires a non-empty KMS key id, CSE_CUSTOM requires a keyring class name). Reaching the default means the method was invoked with a non-CSE algorithm such as SSE-KMS or SSE-S3 -- the caller is expected to have already established the algorithm is CSE.","triggerScenarios":"Directly calling getClientSideEncryptionMaterials with an algorithm enum that is not a CSE variant, or a fork/new enum constant that is client-side-encrypting but was not given a case here.","commonSituations":"Library misuse: routing all encryption algorithms into the CSE materials factory; setting fs.s3a.encryption.algorithm to a server-side value (e.g. SSE-KMS) on a code path that assumes CSE; new encryption methods added to S3AEncryptionMethods in newer hadoop-aws without extending this switch.","solutions":["Use only CSE-KMS or CSE-CUSTOM with this API; server-side algorithms (SSE-S3, SSE-KMS, SSE-C) must not be routed here","Check spelling of fs.s3a.encryption.algorithm: valid CSE values are 'CSE-KMS' and 'CSE-CUSTOM' (older versions fail earlier at enum parse if the token is unknown)","For CSE-KMS set fs.s3a.encryption.key; for CSE-CUSTOM set fs.s3a.encryption.keyring.class -- the Preconditions before this branch enforce them","On custom forks, add a switch case for any new CSE enum constant"],"exampleFix":"<!-- before -->\n<property><name>fs.s3a.encryption.algorithm</name><value>SSE-KMS</value></property>\n<!-- ...routed into CSE materials creation -->\n\n<!-- after: use the CSE spelling only when CSE is intended -->\n<property><name>fs.s3a.encryption.algorithm</name><value>CSE-KMS</value></property>\n<property><name>fs.s3a.encryption.key</name><value>arn:aws:kms:...:key/...</value></property>","handlingStrategy":"validation","validationCode":"String algo = conf.getTrimmed(\"fs.s3a.encryption.algorithm\", \"SSE-S3\");\nif (algo.startsWith(\"CSE\")\n    && !Arrays.asList(\"CSE-KMS\", \"CSE-CUSTOM\").contains(algo)) {\n  throw new IllegalArgumentException(\"Unsupported CSE algorithm: \" + algo\n      + \" (only CSE-KMS and CSE-CUSTOM)\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  CSEMaterials m = CSEUtils.getClientSideEncryptionMaterials(conf, bucket, algorithm);\n} catch (IllegalArgumentException e) {\n  // config-side failure: fix fs.s3a.encryption.algorithm before recreating the client\n  throw new ConfigurationException(\"Bad CSE configuration\", e);\n}","preventionTips":["Spellcheck encryption values: CSE-KMS / CSE-CUSTOM, not 'CSE' or 'CSE_KMS' in config","Pair CSE-KMS with fs.s3a.encryption.key and CSE-CUSTOM with fs.s3a.encryption.keyring.class","Do not route server-side algorithms (SSE-*) into CSE materials creation"],"tags":["s3a","client-side-encryption","configuration","illegal-argument"],"backgroundTag":"invalid-configuration-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}