{"id":"660d60282aeb9050","repo":"mongodb/node-mongodb-native","slug":"could-not-obtain-temporary-mongodb-aws-credentials","errorCode":null,"errorMessage":"Could not obtain temporary MONGODB-AWS credentials","messagePattern":"Could not obtain temporary MONGODB-AWS credentials","errorType":"exception","errorClass":"MongoMissingCredentialsError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_aws.ts","lineNumber":144,"sourceCode":"\n    const saslContinue = {\n      saslContinue: 1,\n      conversationId: saslStartResponse.conversationId,\n      payload: BSON.serialize(payload, bsonOptions)\n    };\n\n    await connection.command(ns(`${db}.$cmd`), saslContinue, undefined);\n  }\n}\n\nasync function makeTempCredentials(\n  credentials: MongoCredentials,\n  awsCredentialFetcher: AWSSDKCredentialProvider\n): Promise<MongoCredentials> {\n  function makeMongoCredentialsFromAWSTemp(creds: AWSTempCredentials) {\n    // The AWS session token (creds.Token) may or may not be set.\n    if (!creds.AccessKeyId || !creds.SecretAccessKey) {\n      throw new MongoMissingCredentialsError('Could not obtain temporary MONGODB-AWS credentials');\n    }\n\n    return new MongoCredentials({\n      username: creds.AccessKeyId,\n      password: creds.SecretAccessKey,\n      source: credentials.source,\n      mechanism: AuthMechanism.MONGODB_AWS,\n      mechanismProperties: {\n        AWS_SESSION_TOKEN: creds.Token\n      }\n    });\n  }\n  const temporaryCredentials = await awsCredentialFetcher.getCredentials();\n\n  return makeMongoCredentialsFromAWSTemp(temporaryCredentials);\n}\n\nfunction deriveRegion(host: string) {","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_aws.ts#L126-L162","documentation":"Thrown when the AWS credential provider chain returned a result, but that result is missing the AccessKeyId or SecretAccessKey fields (src/cmap/auth/mongodb_aws.ts:143). The driver attempted to build MongoCredentials from temporary credentials and found them incomplete. Surfaced as a MongoMissingCredentialsError.","triggerScenarios":"The AWS SDK's fromNodeProviderChain() resolved to a provider that yielded an object without accessKeyId/secretAccessKey (e.g. a partial web-identity or SSO token, or a custom AWSCredentialProvider returning an empty object). Triggered inside makeTempCredentials after getCredentials() returns.","commonSituations":"A custom AWSCredentialProvider passed to MongoClient that returns incomplete data, an expired or partial SSO login, a web-identity token role assumption that silently failed and returned empty, or environment variables set to empty strings.","solutions":["Verify AWS env vars are non-empty: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN for temp creds).","If using a custom credential provider via the driver option, ensure it resolves an object with both accessKeyId and secretAccessKey.","Re-authenticate SSO ('aws sso login') or refresh the web-identity token if using role assumption.","Confirm the EC2/ECS instance metadata service is reachable and the attached role has permission to be assumed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"async function assertAwsCredsComplete(): Promise<void> {\n  // Use the same provider chain the driver uses\n  const { fromNodeProviderChain } = await import('@aws-sdk/credential-providers');\n  const provider = fromNodeProviderChain();\n  const creds = await provider();\n  if (!creds?.accessKeyId || !creds?.secretAccessKey) {\n    throw new Error('AWS provider chain returned incomplete credentials');\n  }\n}\nawait assertAwsCredsComplete();","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoMissingCredentialsError && /temporary MONGODB-AWS credentials/.test(e.message)) {\n    // Refresh SSO / re-assume role / check instance metadata\n    throw new Error('AWS temp credentials incomplete - refresh SSO or check IAM role.');\n  }\n  throw e;\n}","preventionTips":["Pre-flight check: resolve the AWS provider chain at app startup.","For SSO, run 'aws sso login' before starting the app.","When passing a custom AWSCredentialProvider, ensure it always resolves accessKeyId and secretAccessKey."],"tags":["auth","aws","credentials","iam","configuration"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}