{"id":"0042aecded465ba8","repo":"mongodb/node-mongodb-native","slug":"authcontext-must-provide-credentials","errorCode":null,"errorMessage":"AuthContext must provide credentials.","messagePattern":"AuthContext must provide credentials\\.","errorType":"validation","errorClass":"MongoMissingCredentialsError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_aws.ts","lineNumber":41,"sourceCode":"\ninterface AWSSaslContinuePayload {\n  a: string;\n  d: string;\n  t?: string;\n}\n\nexport class MongoDBAWS extends AuthProvider {\n  private credentialFetcher: AWSSDKCredentialProvider;\n\n  constructor(credentialProvider?: AWSCredentialProvider) {\n    super();\n    this.credentialFetcher = new AWSSDKCredentialProvider(credentialProvider);\n  }\n\n  override async auth(authContext: AuthContext): Promise<void> {\n    const { connection } = authContext;\n    if (!authContext.credentials) {\n      throw new MongoMissingCredentialsError('AuthContext must provide credentials.');\n    }\n\n    authContext.credentials = await makeTempCredentials(\n      authContext.credentials,\n      this.credentialFetcher\n    );\n\n    const { credentials } = authContext;\n\n    const accessKeyId = credentials.username;\n    const secretAccessKey = credentials.password;\n    // Allow the user to specify an AWS session token for authentication with temporary credentials.\n    const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;\n\n    // If all three defined, include sessionToken, else only include username and pass\n    const awsCredentials = sessionToken\n      ? { accessKeyId, secretAccessKey, sessionToken }\n      : { accessKeyId, secretAccessKey };","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_aws.ts#L23-L59","documentation":"Thrown by the MONGODB-AWS auth provider when the AuthContext has no credentials object at the start of authentication (src/cmap/auth/mongodb_aws.ts:40). MONGODB-AWS requires either static AWS credentials (access key id as username, secret access key as password) or a resolved set of temporary credentials; with none present the provider cannot proceed. Surfaced as a MongoMissingCredentialsError.","triggerScenarios":"Connecting with authMechanism=MONGODB-AWS but omitting both username/password and any AWS credential source, or when the credential merge step produces an empty credentials object. Also triggered when the AWS SDK credential provider chain fails to find any credentials and the fallback path yields nothing.","commonSituations":"Running locally without AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars set, no attached IAM role on EC2/ECS/EKS, no shared credentials file (~/.aws/credentials), and no credentials passed in the URI. Misconfigured CI environment that lacks AWS permissions.","solutions":["Provide AWS credentials in the connection string: username=<accessKeyId>&password=<secretAccessKey> with authMechanism=MONGODB-AWS.","Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN if using temporary creds) in the environment.","Attach an IAM role to the compute (EC2 instance profile, ECS task role, EKS pod identity) so the AWS SDK credential provider chain can resolve credentials automatically.","Ensure the 'mongodb' (AWS SDK v3) optional dependency is installed if relying on the provider chain."],"exampleFix":"// before\nconst client = new MongoClient('mongodb://host/?authMechanism=MONGODB-AWS');\n\n// after (static creds)\nconst client = new MongoClient(\n  'mongodb://AKIA...:secret@host/?authMechanism=MONGODB-AWS&authSource=%24external'\n);\n// or rely on env/instance role and just specify the mechanism","handlingStrategy":"validation","validationCode":"function hasAwsCredentials(): boolean {\n  return Boolean(\n    (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) ||\n    // or static creds in the URI; check your connection string parse result\n    Boolean(uriUsername && uriPassword)\n  );\n}\nif (mechanism === 'MONGODB-AWS' && !hasAwsCredentials()) {\n  throw new Error('MONGODB-AWS requires AWS credentials (env vars, instance role, or URI username/password).');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoMissingCredentialsError && /MONGODB-AWS|AuthContext/.test(e.message)) {\n    // surface a friendlier message guiding to AWS credential setup\n    throw new Error('No AWS credentials found. Set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or attach an IAM role.');\n  }\n  throw e;\n}","preventionTips":["Run 'aws sts get-caller-identity' in the same environment as the app to confirm the AWS SDK can find credentials.","In CI, inject AWS creds via secure environment variables or an instance role.","Validate that the optional 'mongodb' (AWS SDK) dependency is installed if you rely on the provider chain."],"tags":["auth","aws","credentials","configuration","iam"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}