diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index 28bfea6a5b0..090befc2f18 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -912,6 +912,9 @@ Release 2.6.0 - UNRELEASED
 
     HDFS-7180. NFSv3 gateway frequently gets stuck due to GC (brandonli)
 
+    HDFS-7243. HDFS concat operation should not be allowed in Encryption Zone.
+    (clamb via yliu)
+
     BREAKDOWN OF HDFS-6134 AND HADOOP-10150 SUBTASKS AND RELATED JIRAS
   
       HDFS-6387. HDFS CLI admin tool for creating & deleting an
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java
index c42978c83a0..8f56a99e66e 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSNamesystem.java
@@ -2044,7 +2044,12 @@ public class FSNamesystem implements Namesystem, FSClusterStats,
     // replication and blocks sizes should be the same for ALL the blocks
 
     // check the target
-    final INodeFile trgInode = INodeFile.valueOf(dir.getINode4Write(target),
+    final INodesInPath trgIip = dir.getINodesInPath4Write(target);
+    if (dir.getEZForPath(trgIip) != null) {
+      throw new HadoopIllegalArgumentException(
+          "concat can not be called for files in an encryption zone.");
+    }
+    final INodeFile trgInode = INodeFile.valueOf(trgIip.getLastINode(),
         target);
     if(trgInode.isUnderConstruction()) {
       throw new HadoopIllegalArgumentException("concat: target file "
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java
index c8cefbf6ea3..1f98a623dfd 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/TestEncryptionZones.java
@@ -1221,6 +1221,28 @@ public class TestEncryptionZones {
     fs.delete(target, true);
   }
 
+  @Test(timeout = 60000)
+  public void testConcatFailsInEncryptionZones() throws Exception {
+    final int len = 8192;
+    final Path ez = new Path("/ez");
+    fs.mkdirs(ez);
+    dfsAdmin.createEncryptionZone(ez, TEST_KEY);
+    final Path src1 = new Path(ez, "src1");
+    final Path src2 = new Path(ez, "src2");
+    final Path target = new Path(ez, "target");
+    DFSTestUtil.createFile(fs, src1, len, (short)1, 0xFEED);
+    DFSTestUtil.createFile(fs, src2, len, (short)1, 0xFEED);
+    DFSTestUtil.createFile(fs, target, len, (short)1, 0xFEED);
+    try {
+      fs.concat(target, new Path[] { src1, src2 });
+      fail("expected concat to throw en exception for files in an ez");
+    } catch (IOException e) {
+      assertExceptionContains(
+          "concat can not be called for files in an encryption zone", e);
+    }
+    fs.delete(ez, true);
+  }
+
   /**
    * Test running the OfflineImageViewer on a system with encryption zones.
    */