prestodb/presto · error · PrestoException

NOT_SUPPORTED

NOT_SUPPORTED

Error message

Iceberg table encryption is not supported

What it means

validateTableForPresto() rejects any Iceberg table using encryption: non-empty metadata.encryptionKeys(), a snapshot keyId, or an 'encryption.key-id' table property. Presto does not support reading encrypted Iceberg tables, so it throws NOT_SUPPORTED during getTableHandle.

Source

Thrown at presto-iceberg/src/main/java/com/facebook/presto/iceberg/IcebergAbstractMetadata.java:449

        if (snapshot == null) {
            // empty table, nothing to validate
            return;
        }

        TableMetadata metadata = table.operations().current();
        if (metadata.formatVersion() < MIN_FORMAT_VERSION_FOR_ROW_LINEAGE) {
            return;
        }

        Schema schema = metadata.schemasById().get(snapshot.schemaId());
        if (schema == null) {
            schema = metadata.schema();
        }

        // Reject Iceberg table encryption
        if (!metadata.encryptionKeys().isEmpty() || snapshot.keyId() != null || metadata.properties().containsKey("encryption.key-id")) {
            throw new PrestoException(NOT_SUPPORTED, "Iceberg table encryption is not supported");
        }
    }

    /**
     * This class implements the default implementation for getTableLayoutForConstraint which will be used in the case of a Java Worker
     */
    @Override
    public ConnectorTableLayoutResult getTableLayoutForConstraint(
            ConnectorSession session,
            ConnectorTableHandle table,
            Constraint<ColumnHandle> constraint,
            Optional<Set<ColumnHandle>> desiredColumns)
    {
        Map<String, IcebergColumnHandle> predicateColumns = constraint.getSummary().getDomains()
                .map(domains -> domains.keySet().stream()
                        .map(IcebergColumnHandle.class::cast)
                        .collect(toImmutableMap(IcebergColumnHandle::getName, Functions.identity())))
                .orElse(ImmutableMap.of());

View on GitHub (pinned to 55bb57d202)

Solutions

1. Rewrite the table unencrypted using the engine that wrote it, then query it from Presto.
2. Remove the leftover 'encryption.key-id' table property if encryption is genuinely not in use: ALTER TABLE ... SET PROPERTIES / unset via writer engine.
3. Check snapshots: if a snapshot carries a keyId, roll to a snapshot without encryption or recreate the table from unencrypted data.

Example fix

// before
properties.put("encryption.key-id", "arn:aws:kms:...");
// after
properties.remove("encryption.key-id"); // or recreate table without encryption

Map<String,String> props = table.properties();
boolean encrypted = !table.encryptionKeys().isEmpty() || props.containsKey("encryption.key-id");
if (encrypted) throw new IllegalStateException("Table is encrypted; Presto cannot read it");

try { resolveTable(...); }
catch (PrestoException e) { if (e.getErrorCode() == NOT_SUPPORTED.toErrorCode()) { /* route to engine that supports encryption */ } }

When it happens

Trigger: Querying (or otherwise resolving a table handle for) an Iceberg table that was written with an encryption-enabled writer — e.g. tables encrypted with format-level encryption keys created by other engines.

Common situations: Tables created with Iceberg encryption (key management/KMS integrations) in Spark/Flink then queried from Presto; a stray 'encryption.key-id' property left on the table after encryption was disabled.

Understand the failure class

Background: Presto NOT_SUPPORTED error: what "not supported" means and how to fix it — this error's family across 3 libraries.

Related errors

• NOT_SUPPORTED
• HIVE_UNSUPPORTED_ENCRYPTION_OPERATION
• Unsupported task content: ${task.getContent()}
• NOT_SUPPORTED
• NOT_SUPPORTED

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/8b487a1252898efe. Report an issue: GitHub.