{"record":{"id":"e21bbc8edfac872d","repo":"apache/iceberg","slug":"key-generation-is-not-supported-in-this-kmsclient-e21bbc","errorCode":null,"errorMessage":"Key generation is not supported in this KmsClient","messagePattern":"Key generation is not supported in this KmsClient","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/apache/iceberg/encryption/KeyManagementClient.java","lineNumber":61,"sourceCode":"   * @return true if KMS server supports key generation and KeyManagementClient implementation is\n   *     interested to leverage this capability. Otherwise, return false - Iceberg will then\n   *     generate secret keys locally (using the SecureRandom mechanism) and call {@link\n   *     #wrapKey(ByteBuffer, String)} to wrap them in KMS.\n   */\n  default boolean supportsKeyGeneration() {\n    return false;\n  }\n\n  /**\n   * Generate a new secret key in the KMS server, and wrap it using a wrapping/master key which is\n   * stored in KMS and referenced by an ID. This method will be called only if supportsKeyGeneration\n   * returns true.\n   *\n   * @param wrappingKeyId a key ID that represents a wrapping key stored in KMS\n   * @return key in two forms: raw, and wrapped with the given wrappingKeyId\n   */\n  default KeyGenerationResult generateKey(String wrappingKeyId) {\n    throw new UnsupportedOperationException(\"Key generation is not supported in this KmsClient\");\n  }\n\n  /**\n   * Unwrap a secret key, using a wrapping/master key which is stored in KMS and referenced by an\n   * ID.\n   *\n   * @param wrappedKey wrapped key material (encrypted key and optional KMS metadata, returned by\n   *     the wrapKey method)\n   * @param wrappingKeyId a key ID that represents a wrapping key stored in KMS\n   * @return raw key bytes\n   */\n  ByteBuffer unwrapKey(ByteBuffer wrappedKey, String wrappingKeyId);\n\n  /**\n   * Initialize the KMS client with given properties.\n   *\n   * @param properties kms client properties\n   */","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/core/src/main/java/org/apache/iceberg/encryption/KeyManagementClient.java#L43-L79","documentation":"KeyManagementClient.generateKey is a default method that throws UnsupportedOperationException. Only KMS clients that natively support creating data keys override it; the default implementation signals that this KMS backend cannot generate keys and callers must supply existing wrapped keys instead.","triggerScenarios":"Calling generateKey(wrappingKeyId) on a KeyManagementClient implementation (e.g. a basic KmsClient adapter) that did not override generateKey, typically when creating new encrypted tables with key generation requested.","commonSituations":"Using a custom or third-party KMS client that only supports wrap/unwrap; running envelope encryption flows that require on-demand key creation against a KMS lacking that capability.","solutions":["Implement generateKey in your KeyManagementClient to create and wrap a new data key in your KMS","Switch to a KMS client implementation whose backend supports key generation (e.g. AWS KMS)","Rework the workflow to supply pre-generated wrapped keys instead of calling generateKey"],"exampleFix":"// before\nclient.generateKey(wrappingKeyId); // UnsupportedOperationException\n// after\nif (client.supportsKeyGeneration()) { /* or feature-detect per impl docs */ }\nKeyGenerationResult result = keyGenerationCapableClient.generateKey(wrappingKeyId);","handlingStrategy":"fallback","validationCode":"// feature-detect per implementation docs or capabilities API if available","typeGuard":"boolean supportsKeyGen(KeyManagementClient c) { return !(c.getClass().getPackage().getName().contains(\"basic\")); } // per-impl knowledge","tryCatchPattern":"try { return client.generateKey(wrappingKeyId); }\ncatch (UnsupportedOperationException e) { return fallbackWrap(existingKey, wrappingKeyId); }","preventionTips":["Check your KMS client implementation's docs for key generation support before using generateKey","Prefer official client implementations (e.g. AWS KMS) for key generation flows","Have a pre-generated wrapped key fallback in the workflow"],"tags":["encryption","kms","unsupported-operation"],"backgroundTag":"method-not-implemented","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}