prestodb/presto · error · RuntimeException

Unable to load or create S3 encryption materials provider: $

Error message

Unable to load or create S3 encryption materials provider: ${empClassName}

What it means

If instantiating the configured encryption materials provider fails for any reflective reason (class not found, no no-arg constructor, constructor threw), the connector wraps the ReflectiveOperationException in a RuntimeException with this message. The ${empClassName} in the source message is actually the literal concatenation with the configured class name.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/s3/PrestoS3FileSystem.java:847

        String empClassName = hadoopConfig.get(S3_ENCRYPTION_MATERIALS_PROVIDER);
        if (empClassName == null) {
            return Optional.empty();
        }

        try {
            Object instance = Class.forName(empClassName).getConstructor().newInstance();
            if (!(instance instanceof EncryptionMaterialsProvider)) {
                throw new RuntimeException("Invalid encryption materials provider class: " + instance.getClass().getName());
            }
            EncryptionMaterialsProvider emp = (EncryptionMaterialsProvider) instance;
            if (emp instanceof Configurable) {
                ((Configurable) emp).setConf(hadoopConfig);
            }
            return Optional.of(emp);
        }
        catch (ReflectiveOperationException e) {
            throw new RuntimeException("Unable to load or create S3 encryption materials provider: " + empClassName, e);
        }
    }

    private AWSCredentialsProvider createAwsCredentialsProvider(URI uri, Configuration conf)
    {
        Optional<AWSCredentials> credentials = getAwsCredentials(uri, conf);
        if (credentials.isPresent()) {
            return new AWSStaticCredentialsProvider(credentials.get());
        }

        if (useInstanceCredentials) {
            return InstanceProfileCredentialsProvider.getInstance();
        }

        if (!isNullOrEmpty(s3IamRole)) {
            if (webIdentityEnabled) {
                log.debug("Using Web Identity Token Credentials Provider.");
                WebIdentityTokenCredentialsProvider.Builder providerBuilder = WebIdentityTokenCredentialsProvider.builder()

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the fully-qualified class name spelling in the config.
2. Deploy the provider's jar to the Presto Hive S3 plugin directory and restart.
3. Add a public no-arg constructor to the provider class.
4. Fix exceptions thrown inside the constructor (check logs for the cause chain).

Example fix

// before
hive.s3.encryption-materials-provider=com.example.WrongeNameProvider
// after
hive.s3.encryption-materials-provider=com.example.CorrectKmsMaterialsProvider

String cls = conf.get("hive.s3.encryption-materials-provider");
if (cls != null) {
    try { Class.forName(cls).getDeclaredConstructor(); }
    catch (ClassNotFoundException e) { throw new IllegalStateException("provider not on classpath: " + cls); }
}

null

try {
    createEncryptionMaterialsProvider(...);
} catch (RuntimeException e) {
    if (e.getMessage().startsWith("Unable to load or create S3 encryption materials provider")) {
        LOG.error("check class name, plugin jar deployment, and constructor", e.getCause());
    }
    throw e;
}

When it happens

Trigger: hive.s3.encryption-materials-provider names a class not on the classpath; class lacks a public no-arg constructor; the class's constructor throws (e.g. missing KMS credentials); class not found because the plugin jar isn't deployed.

Common situations: Custom encryption plugin jar missing from the plugin directory; typo in fully-qualified class name; class depends on SDK version not present; constructor reads config that is absent and throws.

Related errors

• Invalid encryption materials provider class:
• EMR File System class not found:
• Error creating an instance of %s
• Error creating an instance of %s for URI %s
• NOT_FOUND

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/62931904e11b0e51. Report an issue: GitHub.