{"id":"29437668f2594604","repo":"mongodb/node-mongodb-native","slug":"aws-session-token-cannot-be-provided-when-using-mo","errorCode":null,"errorMessage":"AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.","messagePattern":"AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS\\. Credentials must be provided in a manner that can be read by the AWS SDK\\.","errorType":"exception","errorClass":"MongoAPIError","httpStatus":null,"severity":"error","filePath":"src/connection_string.ts","lineNumber":429,"sourceCode":"      mongoOptions.dbName &&\n      !allProvidedOptions.has('authSource')\n    ) {\n      // inherit the dbName unless GSSAPI or X509, then silently ignore dbName\n      // and there was no specific authSource given\n      mongoOptions.credentials = MongoCredentials.merge(mongoOptions.credentials, {\n        source: mongoOptions.dbName\n      });\n    }\n\n    if (isAws) {\n      const { username, password } = mongoOptions.credentials;\n      if (username || password) {\n        throw new MongoAPIError(\n          'username and password cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.'\n        );\n      }\n      if (mongoOptions.credentials.mechanismProperties.AWS_SESSION_TOKEN) {\n        throw new MongoAPIError(\n          'AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.'\n        );\n      }\n    }\n\n    mongoOptions.credentials.validate();\n\n    // Check if the only auth related option provided was authSource, if so we can remove credentials\n    if (\n      mongoOptions.credentials.password === '' &&\n      mongoOptions.credentials.username === '' &&\n      mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_DEFAULT &&\n      Object.keys(mongoOptions.credentials.mechanismProperties).length === 0\n    ) {\n      delete mongoOptions.credentials;\n    }\n  }\n","sourceCodeStart":411,"sourceCodeEnd":447,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/connection_string.ts#L411-L447","documentation":"Thrown (as MongoAPIError) when MONGODB-AWS is used and the credentials carry an AWS_SESSION_TOKEN property (connection_string.ts:428-432). Session tokens must come from the AWS SDK credential chain (typically the AWS_SESSION_TOKEN env var) so they pair correctly with temporary access keys; passing them via authMechanismProperties is rejected.","triggerScenarios":"Options like { authMechanism: 'MONGODB-AWS', authMechanismProperties: { AWS_SESSION_TOKEN: '...' } } or a URI embedding session-token via authMechanismProperties.","commonSituations":"Using STS temporary credentials and trying to thread the session token through the URI instead of env vars; copying an AWS SDK sample's credentials object into MongoDB options.","solutions":["Remove AWS_SESSION_TOKEN from authMechanismProperties and the connection string.","Export AWS_SESSION_TOKEN (along with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) as an environment variable.","Prefer an instance/role-based credential source so tokens rotate automatically."],"exampleFix":"// before\nconst c = new MongoClient(uri, {\n  authMechanism: 'MONGODB-AWS',\n  authMechanismProperties: { AWS_SESSION_TOKEN: process.env.AWS_SESSION_TOKEN }\n});\n// after\nconst c = new MongoClient(uri, { authMechanism: 'MONGODB-AWS' });\n// AWS_SESSION_TOKEN is read from env by the AWS SDK automatically","handlingStrategy":"validation","validationCode":"const mech = opts.authMechanism ?? new URL(uri).searchParams.get('authMechanism');\nif (mech === 'MONGODB-AWS' && opts.authMechanismProperties?.AWS_SESSION_TOKEN) {\n  throw new Error('Pass AWS_SESSION_TOKEN via the environment, not authMechanismProperties');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use AWS_SESSION_TOKEN env var for temporary credentials.","Let the AWS SDK own credential resolution end-to-end."],"tags":["connection-string","auth","aws","iam","security"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}