{"record":{"id":"8452064f28307760","repo":"apache/seatunnel","slug":"amazondocumentdb-option-uri-must-include-authent","errorCode":null,"errorMessage":"AmazonDocumentDB option 'uri' must include authentication credentials","messagePattern":"AmazonDocumentDB option 'uri' must include authentication credentials","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java","lineNumber":95,"sourceCode":"                        .map(String::trim)\n                        .filter(value -> !value.isEmpty())\n                        .orElse(null);\n        this.matchQuery = config.get(AmazonDocumentDBSourceOptions.MATCH_QUERY);\n        this.projection =\n                config.getOptional(AmazonDocumentDBSourceOptions.PROJECTION)\n                        .map(String::trim)\n                        .filter(value -> !value.isEmpty())\n                        .orElse(null);\n        this.fetchSize = config.get(AmazonDocumentDBSourceOptions.FETCH_SIZE);\n        this.schema =\n                config.getOptional(ConnectorCommonOptions.SCHEMA)\n                        .map(ReadonlyConfig::fromMap)\n                        .map(ReadonlyConfig::toConfig)\n                        .orElse(null);\n\n        ConnectionString connectionString = parseConnectionString(uri);\n        if (connectionString.getCredential() == null) {\n            throw new IllegalArgumentException(\n                    \"AmazonDocumentDB option 'uri' must include authentication credentials\");\n        }\n        if (hasRetryWritesEnabled(uri)) {\n            throw new IllegalArgumentException(\n                    \"AmazonDocumentDB does not support retryable writes; remove 'retryWrites=true' from option 'uri' or set it to false\");\n        }\n        if (tls) {\n            validateTlsCaFile(tlsCaFile);\n        }\n        validateBsonDocument(matchQuery, \"match.query\");\n        if (projection != null) {\n            validateBsonDocument(projection, \"match.projection\");\n        }\n    }\n\n    /**\n     * Builds driver settings with DocumentDB-safe overrides.\n     *","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-amazondocumentdb/src/main/java/org/apache/seatunnel/connectors/seatunnel/amazondocumentdb/config/AmazonDocumentDBConfig.java#L77-L113","documentation":"AmazonDocumentDBConfig validates the 'uri' option at construction: it parses the connection string and requires embedded authentication credentials (username:password). A URI without a credential component makes ConnectionString.getCredential() return null, and the constructor rejects it with IllegalArgumentException because the connector relies on credentials embedded in the URI.","triggerScenarios":"Constructing AmazonDocumentDBConfig (any DocumentDB source/sink job start) where option 'uri' lacks a user/password component, e.g. 'mongodb://docdb.cluster-xxx.us-east-1.docdb.amazonaws.com:27017' with no credentials, so getCredential() returns null.","commonSituations":"Users pasting a plain DocumentDB cluster endpoint without credentials; credentials supplied via separate options or environment instead of the URI; copying URI examples that omit creds; config interpolation leaving ${VAR} empty so credentials silently vanish.","solutions":["Embed credentials in the URI: mongodb://<user>:<password>@<cluster-endpoint>:27017 and URL-encode special characters in the password","Fetch the credential from AWS Secrets Manager / env substitution and template it into the uri at deploy time","Percent-encode characters like @ : / ? # in the password (e.g. @ -> %40) — an unencoded separator can make the parser treat the URI as credential-less","Verify env/variable interpolation actually resolved so credentials aren't dropped"],"exampleFix":"// before\nuri = \"mongodb://my-docdb-cluster.docdb.amazonaws.com:27017/?tls=true&tlsCAFile=rds-ca.crt\"\n// after\nuri = \"mongodb://admin:myP%40ssw0rd@my-docdb-cluster.docdb.amazonaws.com:27017/?tls=true&tlsCAFile=rds-ca.crt\"","handlingStrategy":"validation","validationCode":"// pre-check the uri before submitting the job\nfunction hasMongoCredentials(uri) {\n  try {\n    const u = new URL(uri.replace(/^mongodb(\\+srv)?:\\/\\//, 'https://'));\n    return Boolean(u.username && u.password);\n  } catch (e) { return false; }\n}\nif (!hasMongoCredentials(process.env.DOCDB_URI)) {\n  throw new Error(\"DOCDB_URI must include username:password, e.g. mongodb://user:pass@host:27017\");\n}","typeGuard":"boolean hasCredentials(String uri) {\n  int schemeEnd = uri.indexOf(\"://\");\n  if (schemeEnd < 0) return false;\n  int at = uri.indexOf('@');\n  if (at < 0) return false;\n  String authority = uri.substring(schemeEnd + 3, at); // user:pass\n  int colon = authority.indexOf(':');\n  return colon > 0 && colon < authority.length() - 1;\n}","tryCatchPattern":"try {\n    AmazonDocumentDBConfig config = new AmazonDocumentDBConfig(readonlyConfig);\n} catch (IllegalArgumentException e) {\n    if (String.valueOf(e.getMessage()).contains(\"must include authentication credentials\")) {\n        throw new IllegalArgumentException(\"Fix the 'uri' option: embed mongodb://<user>:<url-encoded-password>@<host>:27017\", e);\n    }\n    throw e;\n}","preventionTips":["Always template credentials into the uri (Secrets Manager, env substitution) — never ship a credential-less URI","Percent-encode special characters in passwords (@ : / ? # %)","Verify interpolated env variables actually resolve — an empty ${VAR} drops credentials silently","Validate the uri with the MongoDB ConnectionString parser (mongosh or unit test) before deploying"],"tags":["amazondocumentdb","mongodb-uri","authentication","config-validation"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}