{"id":"a609a834148c4649","repo":"mongodb/node-mongodb-native","slug":"username-and-password-cannot-be-provided-when-usin","errorCode":null,"errorMessage":"username and password cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.","messagePattern":"username and password cannot be provided when using MONGODB-AWS\\. Credentials must be provided in a manner that can be read by the AWS SDK\\.","errorType":"exception","errorClass":"MongoAPIError","httpStatus":null,"severity":"error","filePath":"src/connection_string.ts","lineNumber":424,"sourceCode":"      );\n    }\n\n    if (\n      !(isGssapi || isX509 || isAws || isOidc) &&\n      mongoOptions.dbName &&\n      !allProvidedOptions.has('authSource')\n    ) {\n      // inherit the dbName unless GSSAPI or X509, then silently ignore dbName\n      // and there was no specific authSource given\n      mongoOptions.credentials = MongoCredentials.merge(mongoOptions.credentials, {\n        source: mongoOptions.dbName\n      });\n    }\n\n    if (isAws) {\n      const { username, password } = mongoOptions.credentials;\n      if (username || password) {\n        throw new MongoAPIError(\n          'username and password cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.'\n        );\n      }\n      if (mongoOptions.credentials.mechanismProperties.AWS_SESSION_TOKEN) {\n        throw new MongoAPIError(\n          'AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.'\n        );\n      }\n    }\n\n    mongoOptions.credentials.validate();\n\n    // Check if the only auth related option provided was authSource, if so we can remove credentials\n    if (\n      mongoOptions.credentials.password === '' &&\n      mongoOptions.credentials.username === '' &&\n      mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_DEFAULT &&\n      Object.keys(mongoOptions.credentials.mechanismProperties).length === 0","sourceCodeStart":406,"sourceCodeEnd":442,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/connection_string.ts#L406-L442","documentation":"Thrown (as MongoAPIError) when MONGODB-AWS is selected but username or password is present in the credentials (connection_string.ts:421-427). The driver requires AWS credentials to flow through the AWS SDK credential provider chain (env vars, shared config, IMDS, etc.), not through the connection string, so that temporary credentials, instance roles, and SSO work correctly.","triggerScenarios":"URI like 'mongodb://AKIA...:secret@host/?authMechanism=MONGODB-AWS' or options { authMechanism: 'MONGODB-AWS', auth: { username: '...', password: '...' } }.","commonSituations":"Porting SCRAM-style username/password auth to AWS IAM auth and leaving the userinfo in the URI; embedding long-lived access keys in config files (which the driver deliberately discourages).","solutions":["Remove the username:password@ segment from the URI.","Provide AWS credentials via the standard chain: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars, ~/.aws/credentials, an ECS/EC2 instance role, or AWS SSO.","For temporary credentials, set AWS_SESSION_TOKEN env var (not in the URI)."],"exampleFix":"// before\nconst c = new MongoClient('mongodb://AKIAxxxx:secret@host/?authMechanism=MONGODB-AWS');\n// after\n// set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY in the environment\nconst c = new MongoClient('mongodb://host/?authMechanism=MONGODB-AWS');","handlingStrategy":"validation","validationCode":"const mech = opts.authMechanism ?? new URL(uri).searchParams.get('authMechanism');\nconst u = new URL(uri);\nconst hasUser = Boolean(u.username) || opts.auth?.username;\nif (mech === 'MONGODB-AWS' && hasUser) {\n  throw new Error('MONGODB-AWS must not include username/password in the URI; use AWS env vars');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Drive AWS credentials exclusively via the standard credential provider chain.","Never store IAM access keys in connection strings or source control.","Prefer EC2/ECS instance roles or SSO over static keys."],"tags":["connection-string","auth","aws","iam","security"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}