{"record":{"id":"ff797bf9560e0544","repo":"cube-js/cube","slug":"cubejs-db-redshift-aws-region-is-required-for-iam","errorCode":null,"errorMessage":"CUBEJS_DB_REDSHIFT_AWS_REGION is required for IAM authentication","messagePattern":"CUBEJS_DB_REDSHIFT_AWS_REGION is required for IAM authentication","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cubejs-redshift-driver/src/RedshiftIAMCredentialsProvider.ts","lineNumber":37,"sourceCode":"// Refresh 1m before expiry\nconst REFRESH_BUFFER_MS = 60 * 1000;\n\nexport class RedshiftIAMCredentialsProvider implements RedshiftCredentialsProvider {\n  protected readonly region: string;\n\n  protected readonly clusterIdentifier: string;\n\n  protected readonly dbName: string;\n\n  protected readonly awsCredentials?: ReturnType<typeof fromTemporaryCredentials>;\n\n  protected cached: CachedCredentials | null = null;\n\n  protected inflightRefresh: Promise<CachedCredentials> | null = null;\n\n  public constructor(options: RedshiftIAMCredentialProviderOptions) {\n    if (!options.region) {\n      throw new Error('CUBEJS_DB_REDSHIFT_AWS_REGION is required for IAM authentication');\n    }\n\n    if (!options.clusterIdentifier) {\n      throw new Error(\n        'CUBEJS_DB_REDSHIFT_CLUSTER_IDENTIFIER is required for IAM authentication'\n      );\n    }\n\n    if (!options.dbName) {\n      throw new Error(\n        'CUBEJS_DB_NAME is required for IAM authentication'\n      );\n    }\n\n    this.region = options.region;\n    this.clusterIdentifier = options.clusterIdentifier;\n    this.dbName = options.dbName;\n","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-redshift-driver/src/RedshiftIAMCredentialsProvider.ts#L19-L55","documentation":"RedshiftIAMCredentialsProvider generates temporary Redshift credentials via AWS GetClusterCredentials, which requires the cluster's AWS region. Constructing the provider without options.region fails fast with this message pointing at the CUBEJS_DB_REDSHIFT_AWS_REGION env var.","triggerScenarios":"new RedshiftIAMCredentialsProvider({ ... }) called during driver setup with IAM auth enabled when options.region is undefined — typically because CUBEJS_DB_REDSHIFT_AWS_REGION is unset.","commonSituations":"Enabling IAM authentication (CUBEJS_REDSHIFT_AUTH='iam' style setups) but forgetting the region env var; region configured for one environment but not another (staging/prod).","solutions":["Set CUBEJS_DB_REDSHIFT_AWS_REGION (e.g. us-east-1) in the Cube process environment","Pass region explicitly in RedshiftIAMCredentialProviderOptions when constructing programmatically","Verify the env var is loaded (docker env, .env file, secrets manager) before app start"],"exampleFix":"// before\nCUBEJS_DB_REDSHIFT_CLUSTER_IDENTIFIER=my-cluster\n// after\nCUBEJS_DB_REDSHIFT_AWS_REGION=us-east-1\nCUBEJS_DB_REDSHIFT_CLUSTER_IDENTIFIER=my-cluster","handlingStrategy":"validation","validationCode":"if (!process.env.CUBEJS_DB_REDSHIFT_AWS_REGION) {\n  throw new Error('CUBEJS_DB_REDSHIFT_AWS_REGION must be set for IAM auth');\n}","typeGuard":"function hasRegion(o: { region?: string }): o is { region: string } {\n  return typeof o.region === 'string' && o.region.length > 0;\n}","tryCatchPattern":null,"preventionTips":["Set region (and cluster id, db name) together whenever enabling IAM auth","Include IAM env vars in .env.example and deployment templates","Fail fast with a startup config check script"],"tags":["redshift","iam","configuration","missing-env-var"],"backgroundTag":"missing-env-var","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}