cube-js/cube · error

Snowflake encrypted private key provided, but no passphrase

Error message

Snowflake encrypted private key provided, but no passphrase was given.

What it means

The Snowflake driver detects an encrypted PEM private key ('BEGIN ENCRYPTED PRIVATE KEY') and therefore needs a passphrase to decrypt it before passing it to the Snowflake SDK. It reads the passphrase from the snowflakePrivateKeyPass env/config; when it's empty/undefined it throws. Without the passphrase key-based auth cannot be established.

Source

Thrown at packages/cubejs-snowflake-driver/src/SnowflakeDriver.ts:209

    super({
      testConnectionTimeout: config.testConnectionTimeout,
    });

    const dataSource =
      config.dataSource ||
      assertDataSource('default');
    const preAggregations = config.preAggregations || false;

    let privateKey = getEnv('snowflakePrivateKey', { dataSource, preAggregations });

    if (privateKey) {
      // If the private key is encrypted - we need to decrypt it before passing to
      // snowflake sdk.
      if (privateKey.includes('BEGIN ENCRYPTED PRIVATE KEY')) {
        const keyPasswd = getEnv('snowflakePrivateKeyPass', { dataSource, preAggregations });

        if (!keyPasswd) {
          throw new Error(
            'Snowflake encrypted private key provided, but no passphrase was given.'
          );
        }

        const privateKeyObject = crypto.createPrivateKey({
          key: privateKey,
          format: 'pem',
          passphrase: keyPasswd
        });

        privateKey = privateKeyObject.export({
          format: 'pem',
          type: 'pkcs8'
        });
      }
    }

    snowflake.configure({ logLevel: 'OFF' });

View on GitHub (pinned to 7d981676b3)

Solutions

1. Set the CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS environment variable (or snowflakePrivateKeyPass config) with the key passphrase
2. Regenerate the private key unencrypted (`openssl rsa -in key.pem -out key_unencrypted.pem`) and use that instead
3. Verify the env var actually reaches the process (Docker env, .env file, secrets manager)
4. Confirm the key is the one paired with the passphrase (mismatched keys are a related pitfall)

Example fix

// before
CUBEJS_SNOWFLAKE_PRIVATE_KEY=...
// (no passphrase set)

// after
CUBEJS_SNOWFLAKE_PRIVATE_KEY=...
CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS=myKeyPassphrase

const key = process.env.CUBEJS_SNOWFLAKE_PRIVATE_KEY || '';
const pass = process.env.CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS || '';
if (key.includes('BEGIN ENCRYPTED PRIVATE KEY') && !pass) {
  throw new Error('Set CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS for the encrypted key');
}

try {
  const driver = new SnowflakeDriver(options);
} catch (e) {
  if (e.message.includes('no passphrase was given')) {
    console.error('Provide CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS or use an unencrypted key');
  }
  throw e;
}

When it happens

Trigger: Configuring SnowflakeDriver with privateKey set to an encrypted PKCS#8 key while CUBEJS_SNOWFLAKE_PRIVATE_KEY_PASS (or per-datasource env) is unset or empty string.

Common situations: Generating a key with `openssl genrsa ... -aes256` (encrypted) but forgetting the passphrase env var; setting the env var in one environment (local) but not in deployment; per-datasource env naming mismatch in multi-tenant setups.

Related errors

• Unsupported exportBucket configuration, some keys are empty:
• options.checkAuth must be a function
• Provided token isn't for ${dotCubeCloud.url}
• JSON.stringify(deployments)
• Failed to get access token: ${res.statusText}

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/39065125f25744be. Report an issue: GitHub.