{"record":{"id":"7b85019913623932","repo":"mongodb/node-mongodb-native","slug":"error-message","errorCode":null,"errorMessage":"${error.message}","messagePattern":"\\$\\{error\\.message\\}","errorType":"exception","errorClass":"MongoAWSError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/aws_temporary_credentials.ts","lineNumber":126,"sourceCode":"     * Creates a credential provider that will attempt to find credentials from the\n     * following sources (listed in order of precedence):\n     *\n     * - Environment variables exposed via process.env\n     * - SSO credentials from token cache\n     * - Web identity token credentials\n     * - Shared credentials and config ini files\n     * - The EC2/ECS Instance Metadata Service\n     */\n    try {\n      const creds = await this.provider();\n      return {\n        AccessKeyId: creds.accessKeyId,\n        SecretAccessKey: creds.secretAccessKey,\n        Token: creds.sessionToken,\n        Expiration: creds.expiration\n      };\n    } catch (error) {\n      throw new MongoAWSError(error.message, { cause: error });\n    }\n  }\n}\n","sourceCodeStart":108,"sourceCodeEnd":130,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/dce7939f86fb283e167ad709955abedb7bf23124/src/cmap/auth/aws_temporary_credentials.ts#L108-L130","documentation":"Thrown by the AWS temporary-credentials helper when the underlying AWS SDK credential provider (env vars, shared ini, SSO, web identity, EC2/ECS IMDS) rejects. The driver wraps the cause in a MongoAWSError whose message is the underlying provider's error.message. It occurs while obtaining the temporary credentials the driver uses for the MONGODB-AWS mechanism.","triggerScenarios":"AWS auth configured but no valid credentials discoverable: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no ~/.aws/credentials, and the host is not an EC2/ECS role host; the EC2 IMDS endpoint is unreachable; STS AssumeRoleWithWebIdentity failed; shared ini file malformed.","commonSituations":"Running locally without AWS creds configured; ARN role assumption failing due to missing permission; ECS task role not yet available at startup; expired SSO login; ~/.aws/credentials referencing a profile that doesn't exist.","solutions":["Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and optional AWS_SESSION_TOKEN) in the environment, or provide a valid ~/.aws/credentials profile.","If using an EC2/ECS role, verify the task/instance role is attached and IMDS is reachable (169.254.169.254).","For SSO, run `aws sso login` to refresh the short-lived token.","Read the wrapped error.message — it usually states exactly which provider failed and why (e.g. 'Could not load credentials from any providers')."],"exampleFix":"# before: no AWS credentials anywhere\nexport AWS_ACCESS_KEY_ID=''\n# after\nexport AWS_ACCESS_KEY_ID='AKIA...'\nexport AWS_SECRET_ACCESS_KEY='...'\nexport AWS_SESSION_TOKEN='...' # if using STS","handlingStrategy":"validation","validationCode":"function hasAwsCredentials() {\n  return Boolean(\n    process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY\n  ) || fs.existsSync(path.join(os.homedir(), '.aws', 'credentials'));\n}\nif (!hasAwsCredentials()) throw new Error('No AWS credentials found for MONGODB-AWS');","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoAWSError) {\n    // read e.message (the wrapped provider error) to identify which provider failed\n  }\n  throw e;\n}","preventionTips":["Set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN if STS) in the environment.","For EC2/ECS, confirm the role is attached and IMDS reachable before app start.","Run `aws sso login` when using SSO profiles."],"tags":["auth","aws","authentication","iam","credentials"],"backgroundTag":null,"analyzedSha":"dce7939f86fb283e167ad709955abedb7bf23124","analyzedAt":"2026-08-11T04:54:53.215Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}