prestodb/presto · error · RuntimeException

Invalid encryption materials provider class:

Error message

Invalid encryption materials provider class: 

What it means

When hive.s3.encryption-materials-provider names a class, the connector loads it reflectively and requires it to implement com.amazonaws.services.s3.model.EncryptionMaterialsProvider. A class that instantiates but does not implement that interface triggers this RuntimeException.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/s3/PrestoS3FileSystem.java:838

        return clientBuilder.build();
    }

    private static Optional<EncryptionMaterialsProvider> createEncryptionMaterialsProvider(Configuration hadoopConfig)
    {
        String kmsKeyId = hadoopConfig.get(S3_KMS_KEY_ID);
        if (kmsKeyId != null) {
            return Optional.of(new KMSEncryptionMaterialsProvider(kmsKeyId));
        }

        String empClassName = hadoopConfig.get(S3_ENCRYPTION_MATERIALS_PROVIDER);
        if (empClassName == null) {
            return Optional.empty();
        }

        try {
            Object instance = Class.forName(empClassName).getConstructor().newInstance();
            if (!(instance instanceof EncryptionMaterialsProvider)) {
                throw new RuntimeException("Invalid encryption materials provider class: " + instance.getClass().getName());
            }
            EncryptionMaterialsProvider emp = (EncryptionMaterialsProvider) instance;
            if (emp instanceof Configurable) {
                ((Configurable) emp).setConf(hadoopConfig);
            }
            return Optional.of(emp);
        }
        catch (ReflectiveOperationException e) {
            throw new RuntimeException("Unable to load or create S3 encryption materials provider: " + empClassName, e);
        }
    }

    private AWSCredentialsProvider createAwsCredentialsProvider(URI uri, Configuration conf)
    {
        Optional<AWSCredentials> credentials = getAwsCredentials(uri, conf);
        if (credentials.isPresent()) {
            return new AWSStaticCredentialsProvider(credentials.get());
        }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Ensure the configured class implements EncryptionMaterialsProvider and has a no-arg constructor.
2. Wrap custom key material in a class extending KMSEncryptionMaterialsProvider or implementing the interface directly.
3. Check the class package against the AWS SDK version bundled with Presto.
4. Remove the s3.encryption-materials-provider setting if client-side encryption is not needed.

Example fix

// before
public class MyMaterials { /* no interface */ }
// after
public class MyMaterials implements EncryptionMaterialsProvider {
    public MyMaterials() {}
    @Override public EncryptionMaterials getEncryptionMaterials() { ... }
    @Override public void refresh() {}
}

String cls = conf.get("hive.s3.encryption-materials-provider");
if (cls != null) {
    Class<?> c = Class.forName(cls);
    if (!EncryptionMaterialsProvider.class.isAssignableFrom(c)) {
        throw new IllegalStateException(cls + " does not implement EncryptionMaterialsProvider");
    }
    c.getDeclaredConstructor(); // must exist and be public
}

boolean isValidMaterialsProvider(Class<?> c) {
    return EncryptionMaterialsProvider.class.isAssignableFrom(c);
}

try {
    createEncryptionMaterialsProvider(...);
} catch (RuntimeException e) {
    if (e.getMessage().startsWith("Invalid encryption materials provider class:")) {
        // fix the configured class to implement EncryptionMaterialsProvider
    }
    throw e;
}

When it happens

Trigger: Setting s3.encryption-materials-provider to a class that implements a different provider interface (e.g. KMSMaterialsProvider, AWSCredentialsProvider) or a custom class missing the interface.

Common situations: Copy-pasted config from another connector; class compiled against different AWS SDK versions where interface moved packages; implementing KMSEncryptionMaterialsProvider without wrapping in a provider.

Related errors

• Unable to load or create S3 encryption materials provider: $
• Error creating an instance of %s
• Error creating an instance of %s for URI %s
• Unknown file system type:
• EMR File System class not found:

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/e94079e8152b1050. Report an issue: GitHub.