cube-js/cube · error · Error

GetClusterCredentialsWithIAM returned incomplete response

Error message

GetClusterCredentialsWithIAM returned incomplete response

What it means

The Redshift IAM credentials provider calls AWS STS/Redshift GetClusterCredentialsWithIAM and requires DbUser, DbPassword, and Expiration in the response. If AWS returns a response missing any of these fields, the provider cannot build a usable connection credential, so it throws. This indicates an unexpected AWS API response rather than a Cube-side bug.

Source

Thrown at packages/cubejs-redshift-driver/src/RedshiftIAMCredentialsProvider.ts:115

  }

  protected async refreshCredentials(): Promise<CachedCredentials> {
    const client = new RedshiftClient({
      region: this.region,
      ...(this.awsCredentials && { credentials: this.awsCredentials }),
    });

    const command = new GetClusterCredentialsWithIAMCommand({
      ClusterIdentifier: this.clusterIdentifier,
      DbName: this.dbName,
      // By default, it's 15m, 1h is a maximum time
      DurationSeconds: 1800
    });

    const response = await client.send(command);

    if (!response.DbUser || !response.DbPassword || !response.Expiration) {
      throw new Error('GetClusterCredentialsWithIAM returned incomplete response');
    }

    this.cached = {
      user: response.DbUser,
      password: response.DbPassword,
      expiration: response.Expiration,
    };

    return this.cached;
  }
}

View on GitHub (pinned to 7d981676b3)

Solutions

1. Verify the IAM identity has redshift:GetClusterCredentialsWithIAM (or GetCredentials) permitted for the cluster/dbuser resource without conditions that strip fields
2. Log the raw AWS response (client.send(command) result) to see which field is missing
3. Check the AWS SDK version used by cubejs-redshift-driver matches the Redshift Data/API expectations and returns camelCase fields
4. Clear the cached credential (restart the dev server) and retry — a transient AWS issue may resolve on a fresh call
5. If using LocalStack/mocks, ensure the GetClusterCredentialsWithIAM mock returns all three fields

Example fix

// before (partial IAM policy response)
const response = await client.send(command);
this.cached = { user: response.DbUser, ... }; // DbUser undefined -> throws
// after (ensure policy grants credential fields)
// IAM policy statement: {"Effect":"Allow","Action":"redshift:GetClusterCredentialsWithIAM","Resource":["arn:aws:redshift:...:dbuser:cluster/*","arn:aws:redshift:...:dbname:cluster/*"]}

// Wrap credential resolution and verify fields
const response = await client.send(command);
if (!response?.DbUser || !response?.DbPassword || !response?.Expiration) {
  // fail fast with diagnostic before Cube throws
  console.error('GetClusterCredentialsWithIAM missing fields:', Object.keys(response || {}));
}

function hasFullCredentials(r) {
  return !!r && typeof r.DbUser === 'string' && !!r.DbUser &&
         typeof r.DbPassword === 'string' && !!r.DbPassword &&
         r.Expiration instanceof Date;
}

try {
  await dataSource.refreshCredentials();
} catch (e) {
  if (e.message.includes('incomplete response')) {
    // check IAM policy / retry after backoff
    await new Promise(r => setTimeout(r, 1000));
    return dataSource.refreshCredentials();
  }
  throw e;
}

When it happens

Trigger: AWS returns 200 but omits DbUser, DbPassword, or Expiration — typically when IAM permissions are partially granted (e.g. redshift:GetClusterCredentialsWithIAM allowed but the user/DB policy drops fields), when a custom Redshift credential policy filters the response, or when an AWS SDK/proxy/mocking layer returns a partial payload. Raised inside refreshCredentials during resolveCredentials on cache-miss/expiry.

Common situations: Misconfigured IAM policy on the assumed role; environment where an AWS LocalStack/mock or corporate proxy strips response fields; SDK version incompatibility changing response casing; temporary AWS service degradation.

Related errors

• Redshift server does not support more than 32767 parameters,
• CUBEJS_DB_REDSHIFT_AWS_REGION is required for IAM authentica
• CUBEJS_DB_REDSHIFT_CLUSTER_IDENTIFIER is required for IAM au
• CUBEJS_DB_NAME is required for IAM authentication
• Incorrect user name "${user}" or password

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/075d6b4a48aa36d2. Report an issue: GitHub.