Prisma shadow database creation permission error in CI

prisma migrate dev and prisma migrate diff create a temporary shadow database to detect drift. If the connection user cannot CREATE DATABASE, Prisma fails with P3014 before doing any real migration work.

What this error means

prisma migrate dev fails with "P3014: Prisma Migrate could not create the shadow database. Please make sure the database user has permission to create databases." on a managed or restricted Postgres.

prisma output

Error: P3014

Prisma Migrate could not create the shadow database. Please make sure the database
user has permission to create databases. Read more about the shadow database...
Original error: ERROR: permission denied to create database

Common causes

The migrate user cannot create databases

Managed databases often grant a least-privilege user that cannot run CREATE DATABASE, which the shadow database step requires.

Running migrate dev where a shadow database is needed

migrate deploy does not use a shadow database, but migrate dev and diff do; running them in CI against a restricted user triggers P3014.

How to fix it

Provide a shadow database URL

Point Prisma at a separate database the user can manage via shadowDatabaseUrl, so it does not need CREATE DATABASE on the main one.

prisma/schema.prisma

datasource db {
  provider          = "postgresql"
  url               = env("DATABASE_URL")
  shadowDatabaseUrl = env("SHADOW_DATABASE_URL")
}

Use migrate deploy in CI

For applying existing migrations, migrate deploy needs no shadow database and no CREATE DATABASE privilege.

Terminal

npx prisma migrate deploy

How to prevent it

Run migrate deploy in CI/production; reserve migrate dev for local development.
Configure shadowDatabaseUrl when you must run dev/diff against a restricted database.
Grant the dev database user permission to create databases in throwaway CI environments.