{"record":{"id":"15d20e95618d2e19","repo":"hcengineering/platform","slug":"missing-env-variables-for-ses-configuration-mis","errorCode":null,"errorMessage":"Missing env variables for SES configuration: ${missingKeys.join(', ')}","messagePattern":"Missing env variables for SES configuration: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"services/mail/pod-mail/src/config.ts","lineNumber":111,"sourceCode":"  const value: TlsOptions | undefined = Object.values(TlsOptions).find((opt) => opt.toLowerCase() === normalized)\n  if (value === undefined) {\n    throw Error('Invalid SMTP_TLS_MODE value. Must be one of: secure, upgrade, ignore')\n  }\n  return value\n}\n\nconst buildSesConfig = (): SesConfig => {\n  const accessKey = process.env[envMap.SesAccessKey]\n  const secretKey = process.env[envMap.SesSecretKey]\n  const region = process.env[envMap.SesRegion]\n\n  if (isEmpty(accessKey) || isEmpty(secretKey) || isEmpty(region)) {\n    const missingKeys = [\n      isEmpty(accessKey) && 'SES_ACCESS_KEY',\n      isEmpty(secretKey) && 'SES_SECRET_KEY',\n      isEmpty(region) && 'SES_REGION'\n    ].filter(Boolean)\n    throw Error(`Missing env variables for SES configuration: ${missingKeys.join(', ')}`)\n  }\n\n  return {\n    AccessKey: accessKey as string,\n    SecretKey: secretKey as string,\n    Region: region as string\n  }\n}\n\nconst buildSmtpConfig = (): SmtpConfig => {\n  const host = process.env[envMap.SmtpHost]\n  const port = parseNumber(process.env[envMap.SmtpPort])\n  const username = process.env[envMap.SmtpUsername]\n  const password = process.env[envMap.SmtpPassword]\n  const tlsMode = normalizeTlsMode(process.env[envMap.SmtpTlsMode])\n  const debugLog = process.env[envMap.SmtpDebugLog]?.toLowerCase() === 'true'\n  const allowSelfSigned = process.env[envMap.SmtpAllowSelfSigned]?.toLowerCase() === 'true'\n","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/services/mail/pod-mail/src/config.ts#L93-L129","documentation":"buildSesConfig validates the AWS SES credentials required for mail sending. If SES_ACCESS_KEY, SES_SECRET_KEY, or SES_REGION is missing or empty while the service is configured for SES, it throws this error listing exactly which keys are missing.","triggerScenarios":"Starting pod-mail with SES_ACCESS_KEY set (activating the SES path) but with SES_SECRET_KEY and/or SES_REGION unset or empty; keys set only as empty strings; envMap name mismatch in the deployment env.","commonSituations":"Partial AWS IAM credential setup — copying only the access key ID and forgetting the secret; forgetting the region when the team assumed a default; secrets mounted only partially in k8s; running locally without the AWS env vars exported.","solutions":["Set all three: SES_ACCESS_KEY, SES_SECRET_KEY, and SES_REGION in the environment.","Check the error message — it names the missing keys; fix exactly those.","If you intend SMTP instead of SES, remove SES_ACCESS_KEY so the SES path isn't activated.","If using k8s secrets, verify the secret has all three keys and the envFrom/env mapping references it."],"exampleFix":"// before\nSES_ACCESS_KEY=AKIA...\n// after\nSES_ACCESS_KEY=AKIA...\nSES_SECRET_KEY=wJalrXUtnFEMI...\nSES_REGION=us-east-1","handlingStrategy":"validation","validationCode":"const required = ['SES_ACCESS_KEY', 'SES_SECRET_KEY', 'SES_REGION'];\nif (process.env.SES_ACCESS_KEY) { // SES path active\n  const missing = required.filter((k) => !process.env[k]);\n  if (missing.length) {\n    throw new Error(`Missing SES env vars: ${missing.join(', ')}`);\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await import('./config');\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Missing env variables for SES')) {\n    console.error(`SES setup incomplete: ${err.message}`);\n    process.exit(1);\n  }\n  throw err;\n}","preventionTips":["When enabling SES, set access key, secret key, and region together from one source (k8s secret).","Never set SES_ACCESS_KEY as an empty string — it activates the SES path.","Keep AWS SES credentials in one managed secret so they are present or absent as a unit.","Lint deployment manifests for required keys per service."],"tags":["env","configuration","aws","ses","startup"],"backgroundTag":"missing-env-var","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}