{"id":"daab19603ae2b884","repo":"mongodb/node-mongodb-native","slug":"can-only-provide-a-custom-aws-credential-provider-daab19","errorCode":null,"errorMessage":"Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching","messagePattern":"Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching","errorType":"validation","errorClass":"MongoCryptInvalidArgumentError","httpStatus":null,"severity":"error","filePath":"src/client-side-encryption/client_encryption.ts","lineNumber":144,"sourceCode":"   * ```\n   */\n  constructor(client: MongoClient, options: ClientEncryptionOptions) {\n    this._client = client;\n    this._proxyOptions = options.proxyOptions ?? {};\n    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {\n      throw new MongoCryptInvalidArgumentError(\n        'Cannot set both proxyOptions and kmsConnectCallback'\n      );\n    }\n    this._tlsOptions = options.tlsOptions ?? {};\n    this._kmsConnectCallback = options.kmsConnectCallback;\n    this._kmsProviders = options.kmsProviders || {};\n    const { timeoutMS } = resolveTimeoutOptions(client, options);\n    this._timeoutMS = timeoutMS;\n    this._credentialProviders = options.credentialProviders;\n\n    if (options.credentialProviders?.aws && !isEmptyCredentials('aws', this._kmsProviders)) {\n      throw new MongoCryptInvalidArgumentError(\n        'Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching'\n      );\n    }\n\n    if (options.keyVaultNamespace == null) {\n      throw new MongoCryptInvalidArgumentError('Missing required option `keyVaultNamespace`');\n    }\n\n    const mongoCryptOptions: MongoCryptOptions = {\n      ...options,\n      kmsProviders: serialize(this._kmsProviders),\n      errorWrapper: defaultErrorWrapper\n    };\n\n    this._keyVaultNamespace = options.keyVaultNamespace;\n    this._keyVaultClient = options.keyVaultClient || client;\n    const MongoCrypt = ClientEncryption.getMongoCrypt();\n    this._mongoCrypt = new MongoCrypt(mongoCryptOptions);","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/client-side-encryption/client_encryption.ts#L126-L162","documentation":"Same validation as error 28, enforced in the ClientEncryption constructor. Thrown as MongoCryptInvalidArgumentError when credentialProviders.aws is set but kmsProviders.aws contains credentials (not empty). The custom provider is only valid for automatic AWS credential fetching.","triggerScenarios":"Constructing `new ClientEncryption(client, { kmsProviders: { aws: { accessKeyId, secretAccessKey } }, credentialProviders: { aws: cb } })`.","commonSituations":"Reusing autoEncryption-style static AWS credentials with a ClientEncryption that also wires up a credential provider callback; partial migration to dynamic credentials.","solutions":["Set kmsProviders.aws = {} (empty) so the provider callback is used.","Remove credentialProviders.aws to keep using static credentials.","Validate the pairing with isEmptyCredentials('aws', kmsProviders) before constructing."],"exampleFix":"// before\nnew ClientEncryption(client, {\n  keyVaultNamespace: 'enc.keys',\n  kmsProviders: { aws: { accessKeyId, secretAccessKey } },\n  credentialProviders: { aws: awsProvider }\n});\n\n// after\nnew ClientEncryption(client, {\n  keyVaultNamespace: 'enc.keys',\n  kmsProviders: { aws: {} },\n  credentialProviders: { aws: awsProvider }\n});","handlingStrategy":"validation","validationCode":"function validateAws(opt) {\n  const empty = opt.kmsProviders?.aws == null || Object.keys(opt.kmsProviders.aws).length === 0;\n  if (opt.credentialProviders?.aws && !empty)\n    throw new Error('Remove kmsProviders.aws when using credentialProviders.aws');\n}","typeGuard":"type AwsCreds =\n  | { kmsProviders: { aws: Record<string, never> }; credentialProviders: { aws: () => Promise<any> } }\n  | { kmsProviders: { aws: { accessKeyId: string; secretAccessKey: string } }; credentialProviders?: undefined };","tryCatchPattern":"try { new ClientEncryption(client, opt); }\ncatch (err) {\n  if (err instanceof MongoCryptInvalidArgumentError && /automatic AWS credential fetching/.test(err.message)) {\n    /* blank kmsProviders.aws */\n  } else throw err;\n}","preventionTips":["Blank out kmsProviders.aws when supplying a credentialProviders.aws callback.","Share a CSFLE options normalizer across AutoEncrypter and ClientEncryption.","Unit-test the credential pairing before deploying."],"tags":["csfle","configuration","kms","aws","credentials","client-encryption"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}