I have a Next.js 16 (App Router) app deployed to AWS Amplify Hosting (platform: WEB_COMPUTE), provisioned entirely via CDK (AWS::Amplify::App / AWS::Amplify::Branch), region us-west-2. Environment variables configured for the app are visible during the build (confirmed via an explicit echo $DATABASE_URL:+yes in a buildSpec preBuild step, which correctly prints yes), but process.env.DATABASE_URL is undefined inside any server component or API route handler at actual request time — every route touching it fails with Environment variable not found: DATABASE_URL.
Configurations tried, all with the same result:
App-level environmentVariables (via CDK CfnApp.environmentVariables and aws amplify update-app)
Branch-level environmentVariables (aws amplify update-branch)
An IAM service role (iamServiceRole) granting ssm:GetParameter* on /amplify/<appId>/* (in case env vars are proxied through SSM Parameter Store — build logs do show a "---- Setting Up SSM Secrets ----" step)
Editing variables directly in the Amplify Console UI + clicking "Redeploy this version" (not just a CLI-triggered rebuild)
A full fresh deletion and recreation of the Amplify app via CDK (ruling out one-off app corruption)
Separately tried: attaching an IAM "compute role" (computeRoleArn) granted secretsmanager:GetSecretValue on a specific secret, then calling SecretsManagerClient.send(GetSecretValueCommand) from a Next.js instrumentation.ts register() hook at server startup. This fails with:
CredentialsProviderError: Could not load credentials from any providers
— meaning the deployed WEB_COMPUTE runtime doesn't expose IAM role credentials via the AWS SDK v3's standard credential provider chain at all (no env-var creds, no container/instance metadata endpoint reachable).
Question: Is this expected/documented behavior specifically for CDK/CloudFormation-provisioned Amplify apps (as opposed to apps created through the Console's setup wizard)? Is there a supported way to (a) get app/branch environment variables to actually reach the WEB_COMPUTE SSR runtime at request time, or (b) get IAM role credentials discoverable by the AWS SDK at runtime for that same compute? Everything I can find in the docs states environment variables are available "on both the client and the server" for Web Compute apps, which doesn't match what I'm observing.
Happy to provide the app ID / synthesized CloudFormation template if useful — didn't want to post it unprompted here.
