diff --git a/databases/rds-postgres-server/scripts/aws/build_permissions_context b/databases/rds-postgres-server/scripts/aws/build_permissions_context
index 2a2b799..d7a6cac 100755
--- a/databases/rds-postgres-server/scripts/aws/build_permissions_context
+++ b/databases/rds-postgres-server/scripts/aws/build_permissions_context
@@ -26,13 +26,17 @@ if [ -z "${REGION:-}" ]; then
   exit 1
 fi
 
-TFSTATE_BUCKET=$(yaml_value "tfstate_bucket" "" "$VALUES")
 AWS_PROFILE_VAL=$(yaml_value "aws_profile" "" "$VALUES")
 
 if [ -n "${AWS_PROFILE_VAL}" ] && [ -z "${AWS_PROFILE:-}" ]; then
   export AWS_PROFILE="${AWS_PROFILE_VAL}"
 fi
 
+if [ -z "${TFSTATE_BUCKET:-}" ]; then
+  echo "ERROR: TFSTATE_BUCKET is not set. Expected to be exported by build_context." >&2
+  exit 1
+fi
+
 # --- Read service outputs (set by write_service_outputs after RDS creation) -
 
 SERVICE_ID=$(echo "$CONTEXT" | jq -r '.service.id')
diff --git a/databases/rds-postgres-server/workflows/aws/link.yaml b/databases/rds-postgres-server/workflows/aws/link.yaml
index 272e422..7b27a17 100644
--- a/databases/rds-postgres-server/workflows/aws/link.yaml
+++ b/databases/rds-postgres-server/workflows/aws/link.yaml
@@ -7,6 +7,8 @@ steps:
         type: environment
       - name: REGION
         type: environment
+      - name: TFSTATE_BUCKET
+        type: environment
       - name: LINK_ID
         type: environment
       - name: LINK_NAME
diff --git a/databases/rds-postgres-server/workflows/aws/unlink.yaml b/databases/rds-postgres-server/workflows/aws/unlink.yaml
index 062c305..6c0bebe 100644
--- a/databases/rds-postgres-server/workflows/aws/unlink.yaml
+++ b/databases/rds-postgres-server/workflows/aws/unlink.yaml
@@ -7,6 +7,8 @@ steps:
         type: environment
       - name: REGION
         type: environment
+      - name: TFSTATE_BUCKET
+        type: environment
       - name: LINK_ID
         type: environment
       - name: LINK_NAME