{"record":{"id":"39065125f25744be","repo":"cube-js/cube","slug":"snowflake-encrypted-private-key-provided-but-no-p","errorCode":null,"errorMessage":"Snowflake encrypted private key provided, but no passphrase was given.","messagePattern":"Snowflake encrypted private key provided, but no passphrase was given\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cubejs-snowflake-driver/src/SnowflakeDriver.ts","lineNumber":209,"sourceCode":"    super({\n      testConnectionTimeout: config.testConnectionTimeout,\n    });\n\n    const dataSource =\n      config.dataSource ||\n      assertDataSource('default');\n    const preAggregations = config.preAggregations || false;\n\n    let privateKey = getEnv('snowflakePrivateKey', { dataSource, preAggregations });\n\n    if (privateKey) {\n      // If the private key is encrypted - we need to decrypt it before passing to\n      // snowflake sdk.\n      if (privateKey.includes('BEGIN ENCRYPTED PRIVATE KEY')) {\n        const keyPasswd = getEnv('snowflakePrivateKeyPass', { dataSource, preAggregations });\n\n        if (!keyPasswd) {\n          throw new Error(\n            'Snowflake encrypted private key provided, but no passphrase was given.'\n          );\n        }\n\n        const privateKeyObject = crypto.createPrivateKey({\n          key: privateKey,\n          format: 'pem',\n          passphrase: keyPasswd\n        });\n\n        privateKey = privateKeyObject.export({\n          format: 'pem',\n          type: 'pkcs8'\n        });\n      }\n    }\n\n    snowflake.configure({ logLevel: 'OFF' });","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-snowflake-driver/src/SnowflakeDriver.ts#L191-L227","documentation":"The Snowflake driver detects an encrypted PEM private key ('BEGIN ENCRYPTED PRIVATE KEY') and therefore needs a passphrase to decrypt it before passing it to the Snowflake SDK. It reads the passphrase from the snowflakePrivateKeyPass env/config; when it's empty/undefined it throws. Without the passphrase key-based auth cannot be established.","triggerScenarios":"Configuring SnowflakeDriver with privateKey set to an encrypted PKCS#8 key while CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS (or per-datasource env) is unset or empty string.","commonSituations":"Generating a key with `openssl genrsa ... -aes256` (encrypted) but forgetting the passphrase env var; setting the env var in one environment (local) but not in deployment; per-datasource env naming mismatch in multi-tenant setups.","solutions":["Set the CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS environment variable (or snowflakePrivateKeyPass config) with the key passphrase","Regenerate the private key unencrypted (`openssl rsa -in key.pem -out key_unencrypted.pem`) and use that instead","Verify the env var actually reaches the process (Docker env, .env file, secrets manager)","Confirm the key is the one paired with the passphrase (mismatched keys are a related pitfall)"],"exampleFix":"// before\nCUBEJS_SNOWFLAKE_PRIVATE_KEY=...\n// (no passphrase set)\n\n// after\nCUBEJS_SNOWFLAKE_PRIVATE_KEY=...\nCUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS=myKeyPassphrase","handlingStrategy":"validation","validationCode":"const key = process.env.CUBEJS_SNOWFLAKE_PRIVATE_KEY || '';\nconst pass = process.env.CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS || '';\nif (key.includes('BEGIN ENCRYPTED PRIVATE KEY') && !pass) {\n  throw new Error('Set CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS for the encrypted key');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const driver = new SnowflakeDriver(options);\n} catch (e) {\n  if (e.message.includes('no passphrase was given')) {\n    console.error('Provide CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS or use an unencrypted key');\n  }\n  throw e;\n}","preventionTips":["Keep key and passphrase env vars paired in every environment's secrets","Prefer unencrypted keys stored in a secrets manager over encrypted keys with passphrases","Verify env vars are present in deployment (docker inspect / startup checks)","Document per-datasource env naming when using multi-datasource setups"],"tags":["snowflake","private-key","missing-env-var","authentication"],"backgroundTag":"missing-passphrase","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}