cube-js/cube · error · Error

Unsupported configuration exportBucket, some configuration k

Error message

Unsupported configuration exportBucket, some configuration keys are empty: ${emptySecretKeys.join(',')}

What it means

If exportBucket.unloadArn is not set, Redshift needs direct AWS credentials (keyId and secretKey) to authorize the UNLOAD. The driver checks every exportBucket key except unloadArn and throws listing any that are undefined.

Source

Thrown at packages/cubejs-redshift-driver/src/RedshiftDriver.ts:383

        );
      }

      // Make sure the required keys are set
      const emptyRequiredKeys = Object.keys(requiredExportBucket)
        .filter((key: string) => requiredExportBucket[<keyof RedshiftDriverExportRequiredAWS>key] === undefined);
      if (emptyRequiredKeys.length) {
        throw new Error(
          `Unsupported configuration exportBucket, some configuration keys are empty: ${emptyRequiredKeys.join(',')}`
        );
      }
      // If unload ARN is not set, secret and key id must be set for Redshift
      if (!exportBucket.unloadArn) {
        // Make sure the required keys are set
        const emptySecretKeys = Object.keys(exportBucket)
          .filter((key: string) => key !== 'unloadArn')
          .filter((key: string) => exportBucket[<keyof RedshiftDriverExportAWS>key] === undefined);
        if (emptySecretKeys.length) {
          throw new Error(
            `Unsupported configuration exportBucket, some configuration keys are empty: ${emptySecretKeys.join(',')}`
          );
        }
      }

      return <RedshiftDriverExportAWS>exportBucket;
    }

    return undefined;
  }

  public async loadUserDefinedTypes(): Promise<void> {
    // @todo Implement for Redshift, column \"typcategory\" does not exist in pg_type
  }

  public override async tableColumnTypes(table: string): Promise<TableStructure> {
    const columns: TableStructure = await super.tableColumnTypes(table);

View on GitHub (pinned to 7d981676b3)

Solutions

  1. Provide CUBEJS_EXPORT_BUCKET_AWS_KEY and CUBEJS_EXPORT_BUCKET_AWS_SECRET when not using an unload ARN
  2. If intending ARN-based auth, correctly set CUBEJS_EXPORT_BUCKET_UNLOAD_ARN (a valid Redshift IAM role ARN)
  3. Check for typos in env var names and that the vars are visible to the Cube process

Example fix

// before (intended ARN auth, arn typo'd)
CUBEJS_EXPORT_BUCKET_UNLOADARN=arn:aws:iam::...
// after
CUBEJS_EXPORT_BUCKET_UNLOAD_ARN=arn:aws:iam::...
Defensive patterns

Strategy: validation

Validate before calling

const eb = {
  bucketType: process.env.CUBEJS_EXPORT_BUCKET_TYPE,
  bucketName: process.env.CUBEJS_EXPORT_BUCKET_NAME,
  keyId: process.env.CUBEJS_EXPORT_BUCKET_AWS_KEY,
  secretKey: process.env.CUBEJS_EXPORT_BUCKET_AWS_SECRET,
  unloadArn: process.env.CUBEJS_EXPORT_BUCKET_UNLOAD_ARN
};
if (!eb.unloadArn) {
  const empty = Object.keys(eb).filter(k => k !== 'unloadArn' && !eb[k]);
  if (empty.length) throw new Error(`exportBucket without unloadArn requires: ${empty.join(',')}`);
}

Prevention

When it happens

Trigger: getExportBucket (via getInitialConfiguration) sees an exportBucket without unloadArn and at least one of keyId / secretKey / bucketType / bucketName undefined — e.g. only the ARN-adjacent fields were partially filled.

Common situations: User provides an unloadArn but it is empty-string or a typo'd env var name so it reads undefined; user switches from ARN-based to credential-based auth and forgets key/secret.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/6db5b95463991a4a. Report an issue: GitHub.