{"record":{"id":"c69bb35e7e10ce6a","repo":"ToolJet/ToolJet","slug":"invalid-credentials-configuration","errorCode":null,"errorMessage":"Invalid credentials configuration","messagePattern":"Invalid credentials configuration","errorType":"validation","errorClass":"QueryError","httpStatus":null,"severity":"error","filePath":"marketplace/plugins/aws-bedrock/lib/index.ts","lineNumber":162,"sourceCode":"        } else if (error.name === \"AccessDeniedException\") {\n          errorMessage = \"Insufficient permissions\";\n        }\n      }\n\n      throw new QueryError(\n        errorMessage,\n        error.message,\n        errorDetails\n      );\n    }\n  }\n\n  private validateCredentials(sourceOptions: SourceOptions): void {\n    const hasAccessKey = sourceOptions.access_key && sourceOptions.secret_access_key;\n    const hasSessionToken = sourceOptions.session_token;\n\n    if (hasSessionToken && !hasAccessKey) {\n      throw new QueryError(\n        \"Invalid credentials configuration\",\n        \"Session tokens require temporary credentials (access key + secret + token)\",\n        {\n          validation: {\n            error: \"session_token_requires_access_keys\"\n          }\n        }\n      );\n    }\n\n    if (!hasAccessKey) {\n      throw new QueryError(\n        \"Invalid credentials configuration\",\n        \"Access key and secret access key are required\",\n        {\n          validation: {\n            missing: \"access_credentials_required\"\n          }","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/ToolJet/ToolJet/blob/20602a8e101f2e59686c9afde0d1402aac2c8871/marketplace/plugins/aws-bedrock/lib/index.ts#L144-L180","documentation":"Thrown by validateCredentials() when a session_token is supplied without a matching access_key + secret_access_key pair. AWS session tokens are only valid as part of temporary STS credentials (the triple access key + secret + token), so a lone token cannot authenticate any SDK call.","triggerScenarios":"A user pastes only the session_token field (e.g. copied from an SSO browser URL or a partial AWS_SSO cache) and leaves access_key / secret_access_key blank, or swaps the secret into the session_token field by mistake.","commonSituations":"Confusing the three STS fields when copying from `aws sts get-session-token` output; using an SSO start-url that emits a token but no long-lived keys; form auto-fill putting the wrong value in the session_token box.","solutions":["Run `aws sts get-session-token` (or `aws sso login` for SSO) and copy all three returned values: AccessKeyId, SecretAccessKey, SessionToken.","Paste AccessKeyId -> access_key, SecretAccessKey -> secret_access_key, SessionToken -> session_token.","If you only have long-lived keys, clear the session_token field entirely.","Re-test the connection after saving."],"exampleFix":"// before\nsourceOptions = { session_token: 'FwoGZXI...' } // missing access_key + secret\n// after\nsourceOptions = {\n  access_key: 'AKIA...',\n  secret_access_key: 'wJalrXU...',\n  session_token: 'FwoGZXI...'\n}","handlingStrategy":"validation","validationCode":"function validateCreds(opts: { access_key?: string; secret_access_key?: string; session_token?: string }) {\n  if (opts.session_token && !(opts.access_key && opts.secret_access_key)) {\n    throw new Error('session_token requires access_key + secret_access_key');\n  }\n}","typeGuard":"function isCompleteStsTriple(opts: any): opts is { access_key: string; secret_access_key: string; session_token: string } {\n  return Boolean(opts.access_key && opts.secret_access_key && opts.session_token);\n}","tryCatchPattern":null,"preventionTips":["Always copy all three fields from aws sts get-session-token together.","Disable the session_token field in the UI when the user only has long-lived keys.","Show a hint next to session_token: 'Only for temporary STS credentials'."],"tags":["aws","credentials","sts","validation"],"backgroundTag":null,"analyzedSha":"20602a8e101f2e59686c9afde0d1402aac2c8871","analyzedAt":"2026-08-13T05:58:54.221Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}