{"record":{"id":"c84e23606098fcfa","repo":"apache/hadoop","slug":"sse-c-is-enabled-but-no-encryption-key-was-declare","errorCode":null,"errorMessage":"SSE-C is enabled but no encryption key was declared in fs.s3a.encryption.key","messagePattern":"SSE-C is enabled but no encryption key was declared in fs\\.s3a\\.encryption\\.key","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java","lineNumber":1512,"sourceCode":"      // old key, global setting, for JCEKS entries.\n      algorithm = lookupPassword(null, conf, SERVER_SIDE_ENCRYPTION_ALGORITHM);\n    }\n    // now determine the algorithm\n    final S3AEncryptionMethods encryptionMethod = S3AEncryptionMethods.getMethod(algorithm);\n\n    // look up the encryption key\n    String encryptionKey = getS3EncryptionKey(bucket, conf,\n        encryptionMethod.requiresSecret());\n    int encryptionKeyLen =\n        StringUtils.isBlank(encryptionKey) ? 0 : encryptionKey.length();\n    String diagnostics = passwordDiagnostics(encryptionKey, \"key\");\n    String encryptionContext = S3AEncryption.getS3EncryptionContextBase64Encoded(bucket, conf,\n        encryptionMethod.requiresSecret());\n    switch (encryptionMethod) {\n    case SSE_C:\n      LOG.debug(\"Using SSE-C with {}\", diagnostics);\n      if (encryptionKeyLen == 0) {\n        throw new IOException(SSE_C_NO_KEY_ERROR);\n      }\n      break;\n\n    case SSE_S3:\n      if (encryptionKeyLen != 0) {\n        throw new IOException(SSE_S3_WITH_KEY_ERROR\n            + \" (\" + diagnostics + \")\");\n      }\n      break;\n\n    case SSE_KMS:\n      LOG.debug(\"Using SSE-KMS with {}\",\n          diagnostics);\n      break;\n\n    case CSE_KMS:\n      LOG.debug(\"Using CSE-KMS with {}\",\n          diagnostics);","sourceCodeStart":1494,"sourceCodeEnd":1530,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AUtils.java#L1494-L1530","documentation":"IOException thrown while building S3 client encryption settings: fs.s3a.encryption.algorithm is SSE-C but fs.s3a.encryption.key is empty. SSE-C is server-side encryption with customer-provided keys, so the key is mandatory; S3A looks it up (config or credential store, with password diagnostics) and fails fast at filesystem initialization.","triggerScenarios":"fs.s3a.encryption.algorithm=SSE-C with fs.s3a.encryption.key unset, blank, or not resolvable through the configured credential provider; per-bucket SSE-C config (fs.s3a.bucket.<bucket>.encryption.key) missing while the bucket uses SSE-C.","commonSituations":"Adding SSE-C to an existing bucket config and forgetting the key; key stored in a JCEKS provider that is not deployed to worker nodes; blank/whitespace values after templating; encryption secrets lost when switching to delegation tokens.","solutions":["Set fs.s3a.encryption.key to the base-64-encoded AES-256 key SSE-C requires","If the key should come from a credential store, add it there and verify with hadoop credential list -provider ...","Check per-bucket overrides: fs.s3a.bucket.<bucket>.encryption.key must also be non-empty for buckets using SSE-C","If SSE-C was not intended, change or remove fs.s3a.encryption.algorithm"],"exampleFix":"<!-- before -->\n<property><name>fs.s3a.encryption.algorithm</name><value>SSE-C</value></property>\n<!-- fs.s3a.encryption.key missing -> IOException at fs init -->\n\n<!-- after -->\n<property><name>fs.s3a.encryption.algorithm</name><value>SSE-C</value></property>\n<property><name>fs.s3a.encryption.key</name><value>base64-encoded-32-byte-key</value></property>","handlingStrategy":"validation","validationCode":"String alg = conf.getTrimmed(\"fs.s3a.encryption.algorithm\", \"\");\nif (\"SSE-C\".equalsIgnoreCase(alg)) {\n  char[] key = conf.getPassword(\"fs.s3a.encryption.key\");\n  if (key == null || new String(key).trim().isEmpty()) {\n    throw new IOException(\"SSE-C selected but fs.s3a.encryption.key is unset\");\n  }\n}","typeGuard":null,"tryCatchPattern":"catch IOException containing 'SSE-C is enabled but no encryption key' at filesystem initialization; surface as a configuration defect with the exact property to set - not retryable","preventionTips":["Keep fs.s3a.encryption.algorithm and key paired in the same config template","Store the encryption key in the Hadoop credential store rather than XML","Add an integration test that initializes the filesystem with production encryption settings"],"tags":["s3a","hadoop-aws","encryption","sse-c","configuration","credentials"],"backgroundTag":"missing-encryption-key","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}