diff --git a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java
index 61916e091db..9a1772ce878 100644
--- a/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java
+++ b/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/common/ClientBuilderFactory.java
@@ -203,11 +203,11 @@ public <BuilderT extends AwsClientBuilder<BuilderT, ClientT>, ClientT> BuilderT
                 httpConfig.socketTimeout(), client::writeTimeout); // fallback for writeTimeout
             setOptional(httpConfig.writeTimeout(), client::writeTimeout);
             setOptional(httpConfig.maxConnections(), client::maxConcurrency);
-
-            // TODO - gate this behind a flag.
-            client.tlsKeyManagersProvider(NoneTlsKeyManagersProvider.getInstance());
           }
 
+          // TODO - gate this behind a flag.
+          client.tlsKeyManagersProvider(NoneTlsKeyManagersProvider.getInstance());
+
           // must use builder to make sure client is managed by the SDK
           ((SdkAsyncClientBuilder<?, ?>) builder).httpClientBuilder(client);
         }