diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java
index 85aa99cea36..55c6341f185 100644
--- a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java
@@ -184,6 +184,8 @@ public <BuilderT extends AwsClientBuilder<BuilderT, ClientT>, ClientT> BuilderT
 
           if (skipCertificateVerification) {
             client.tlsKeyManagersProvider(NoneTlsKeyManagersProvider.getInstance());
+            throw new RuntimeException(
+                "Made it this far (SdkSyncClientBuilder) - probably means the tlsKeyManagersProvider is not right");
           }
 
           // must use builder to make sure client is managed by the SDK
@@ -212,10 +214,14 @@ public <BuilderT extends AwsClientBuilder<BuilderT, ClientT>, ClientT> BuilderT
 
           if (skipCertificateVerification) {
             client.tlsKeyManagersProvider(NoneTlsKeyManagersProvider.getInstance());
+            throw new RuntimeException(
+                "Made it this far (SdkAsyncClientBuilder) - probably means the tlsKeyManagersProvider is not right");
           }
 
           // must use builder to make sure client is managed by the SDK
           ((SdkAsyncClientBuilder<?, ?>) builder).httpClientBuilder(client);
+        } else {
+          throw new RuntimeException("Surprising builder type: " + builder.toString());
         }
       }
       return builder;