{"record":{"id":"7bf83a1898ece993","repo":"BerriAI/litellm","slug":"iam-token-db-auth-is-enabled-but-required-db-env-v","errorCode":null,"errorMessage":"IAM_TOKEN_DB_AUTH is enabled but required DB env var(s) are unset: {', '.join(missing)}. Set them so the writer DATABASE_URL can be assembled with a minted IAM token.","messagePattern":"IAM_TOKEN_DB_AUTH is enabled but required DB env var\\(s\\) are unset: (.+?)\\. Set them so the writer DATABASE_URL can be assembled with a minted IAM token\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/db/db_url_settings.py","lineNumber":143,"sourceCode":"    def build_writer_url(self) -> str | None:\n        \"\"\"Return the writer URL to set, or ``None`` to leave it as-is.\n\n        Raises ``RuntimeError`` (naming the offending vars) when IAM auth is\n        enabled but a required field is missing — the proxy cannot recover\n        from this and a clear startup error beats a Prisma connect failure.\n        \"\"\"\n        if self.iam_token_db_auth:\n            missing: Final = [\n                env\n                for env, val in (\n                    (\"DATABASE_HOST\", self.database_host),\n                    (\"DATABASE_USER\", self.database_user),\n                    (\"DATABASE_NAME\", self.database_name),\n                )\n                if not val\n            ]\n            if missing:\n                raise RuntimeError(\n                    \"IAM_TOKEN_DB_AUTH is enabled but required DB env var(s) \"\n                    f\"are unset: {', '.join(missing)}. Set them so the writer \"\n                    \"DATABASE_URL can be assembled with a minted IAM token.\"\n                )\n            host: Final = cast(str, self.database_host)\n            user: Final = cast(str, self.database_user)\n            name: Final = cast(str, self.database_name)\n            # IAM token is already URL-quoted by generate_iam_auth_token;\n            # user/name embedded raw (parity with proxy_cli.py / IAMEndpoint).\n            token: Final = rds_iam_token.generate_iam_auth_token(db_host=host, db_port=self.database_port, db_user=user)\n            url = f\"postgresql://{user}:{token}@{host}:{self.database_port}/{name}\"\n            if self.database_schema:\n                url += f\"?schema={self.database_schema}\"\n            return url\n\n        # Password auth: an operator-pinned DATABASE_URL always wins.\n        if self.database_url:\n            return None","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/db/db_url_settings.py#L125-L161","documentation":"Error \"IAM_TOKEN_DB_AUTH is enabled but required DB env var(s) are unset: {', '.join(missing)}. Set them so the writer DATABASE_URL can be assembled with a minted IAM token.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/db/db_url_settings.py:143 when the library encounters an invalid state.","commonSituations":"IAM_TOKEN_DB_AUTH is enabled but the env vars needed to build the writer DATABASE_URL are unset.","solutions":["Set the listed missing DB env vars (host, port, user, database name) so the writer DATABASE_URL can be assembled."],"exampleFix":"export DATABASE_HOST=... DATABASE_PORT=5432 DATABASE_USER=... DATABASE_NAME=...","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}