hcengineering/platform · error · Error

Missing env variables for SES configuration: ${missingKeys.j

Error message

Missing env variables for SES configuration: ${missingKeys.join(', ')}

What it means

buildSesConfig validates the AWS SES credentials required for mail sending. If SES_ACCESS_KEY, SES_SECRET_KEY, or SES_REGION is missing or empty while the service is configured for SES, it throws this error listing exactly which keys are missing.

Source

Thrown at services/mail/pod-mail/src/config.ts:111

  const value: TlsOptions | undefined = Object.values(TlsOptions).find((opt) => opt.toLowerCase() === normalized)
  if (value === undefined) {
    throw Error('Invalid SMTP_TLS_MODE value. Must be one of: secure, upgrade, ignore')
  }
  return value
}

const buildSesConfig = (): SesConfig => {
  const accessKey = process.env[envMap.SesAccessKey]
  const secretKey = process.env[envMap.SesSecretKey]
  const region = process.env[envMap.SesRegion]

  if (isEmpty(accessKey) || isEmpty(secretKey) || isEmpty(region)) {
    const missingKeys = [
      isEmpty(accessKey) && 'SES_ACCESS_KEY',
      isEmpty(secretKey) && 'SES_SECRET_KEY',
      isEmpty(region) && 'SES_REGION'
    ].filter(Boolean)
    throw Error(`Missing env variables for SES configuration: ${missingKeys.join(', ')}`)
  }

  return {
    AccessKey: accessKey as string,
    SecretKey: secretKey as string,
    Region: region as string
  }
}

const buildSmtpConfig = (): SmtpConfig => {
  const host = process.env[envMap.SmtpHost]
  const port = parseNumber(process.env[envMap.SmtpPort])
  const username = process.env[envMap.SmtpUsername]
  const password = process.env[envMap.SmtpPassword]
  const tlsMode = normalizeTlsMode(process.env[envMap.SmtpTlsMode])
  const debugLog = process.env[envMap.SmtpDebugLog]?.toLowerCase() === 'true'
  const allowSelfSigned = process.env[envMap.SmtpAllowSelfSigned]?.toLowerCase() === 'true'

View on GitHub (pinned to 63e28dc964)

Solutions

Set all three: SES_ACCESS_KEY, SES_SECRET_KEY, and SES_REGION in the environment.
Check the error message — it names the missing keys; fix exactly those.
If you intend SMTP instead of SES, remove SES_ACCESS_KEY so the SES path isn't activated.
If using k8s secrets, verify the secret has all three keys and the envFrom/env mapping references it.

Example fix

// before
SES_ACCESS_KEY=AKIA...
// after
SES_ACCESS_KEY=AKIA...
SES_SECRET_KEY=wJalrXUtnFEMI...
SES_REGION=us-east-1

Defensive patterns

Strategy: validation

Validate before calling

const required = ['SES_ACCESS_KEY', 'SES_SECRET_KEY', 'SES_REGION'];
if (process.env.SES_ACCESS_KEY) { // SES path active
  const missing = required.filter((k) => !process.env[k]);
  if (missing.length) {
    throw new Error(`Missing SES env vars: ${missing.join(', ')}`);
  }
}

Try / catch

try {
  await import('./config');
} catch (err) {
  if (err instanceof Error && err.message.startsWith('Missing env variables for SES')) {
    console.error(`SES setup incomplete: ${err.message}`);
    process.exit(1);
  }
  throw err;
}

Prevention

When enabling SES, set access key, secret key, and region together from one source (k8s secret).
Never set SES_ACCESS_KEY as an empty string — it activates the SES path.
Keep AWS SES credentials in one managed secret so they are present or absent as a unit.
Lint deployment manifests for required keys per service.

When it happens

Trigger: Starting pod-mail with SES_ACCESS_KEY set (activating the SES path) but with SES_SECRET_KEY and/or SES_REGION unset or empty; keys set only as empty strings; envMap name mismatch in the deployment env.

Common situations: Partial AWS IAM credential setup — copying only the access key ID and forgetting the secret; forgetting the region when the team assumed a default; secrets mounted only partially in k8s; running locally without the AWS env vars exported.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/15d20e95618d2e19. Report an issue: GitHub.