mongodb/node-mongodb-native · error · MongoCryptInvalidArgumentError

Can only provide a custom AWS credential provider when the s

Error message

Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching

What it means

Same validation as error 28, enforced in the ClientEncryption constructor. Thrown as MongoCryptInvalidArgumentError when credentialProviders.aws is set but kmsProviders.aws contains credentials (not empty). The custom provider is only valid for automatic AWS credential fetching.

Source

Thrown at src/client-side-encryption/client_encryption.ts:144

   * ```
   */
  constructor(client: MongoClient, options: ClientEncryptionOptions) {
    this._client = client;
    this._proxyOptions = options.proxyOptions ?? {};
    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {
      throw new MongoCryptInvalidArgumentError(
        'Cannot set both proxyOptions and kmsConnectCallback'
      );
    }
    this._tlsOptions = options.tlsOptions ?? {};
    this._kmsConnectCallback = options.kmsConnectCallback;
    this._kmsProviders = options.kmsProviders || {};
    const { timeoutMS } = resolveTimeoutOptions(client, options);
    this._timeoutMS = timeoutMS;
    this._credentialProviders = options.credentialProviders;

    if (options.credentialProviders?.aws && !isEmptyCredentials('aws', this._kmsProviders)) {
      throw new MongoCryptInvalidArgumentError(
        'Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching'
      );
    }

    if (options.keyVaultNamespace == null) {
      throw new MongoCryptInvalidArgumentError('Missing required option `keyVaultNamespace`');
    }

    const mongoCryptOptions: MongoCryptOptions = {
      ...options,
      kmsProviders: serialize(this._kmsProviders),
      errorWrapper: defaultErrorWrapper
    };

    this._keyVaultNamespace = options.keyVaultNamespace;
    this._keyVaultClient = options.keyVaultClient || client;
    const MongoCrypt = ClientEncryption.getMongoCrypt();
    this._mongoCrypt = new MongoCrypt(mongoCryptOptions);

View on GitHub (pinned to 3366c21a63)

Solutions

1. Set kmsProviders.aws = {} (empty) so the provider callback is used.
2. Remove credentialProviders.aws to keep using static credentials.
3. Validate the pairing with isEmptyCredentials('aws', kmsProviders) before constructing.

Example fix

// before
new ClientEncryption(client, {
  keyVaultNamespace: 'enc.keys',
  kmsProviders: { aws: { accessKeyId, secretAccessKey } },
  credentialProviders: { aws: awsProvider }
});

// after
new ClientEncryption(client, {
  keyVaultNamespace: 'enc.keys',
  kmsProviders: { aws: {} },
  credentialProviders: { aws: awsProvider }
});

function validateAws(opt) {
  const empty = opt.kmsProviders?.aws == null || Object.keys(opt.kmsProviders.aws).length === 0;
  if (opt.credentialProviders?.aws && !empty)
    throw new Error('Remove kmsProviders.aws when using credentialProviders.aws');
}

type AwsCreds =
  | { kmsProviders: { aws: Record<string, never> }; credentialProviders: { aws: () => Promise<any> } }
  | { kmsProviders: { aws: { accessKeyId: string; secretAccessKey: string } }; credentialProviders?: undefined };

try { new ClientEncryption(client, opt); }
catch (err) {
  if (err instanceof MongoCryptInvalidArgumentError && /automatic AWS credential fetching/.test(err.message)) {
    /* blank kmsProviders.aws */
  } else throw err;
}

When it happens

Trigger: Constructing `new ClientEncryption(client, { kmsProviders: { aws: { accessKeyId, secretAccessKey } }, credentialProviders: { aws: cb } })`.

Common situations: Reusing autoEncryption-style static AWS credentials with a ClientEncryption that also wires up a credential provider callback; partial migration to dynamic credentials.

Related errors

• Can only provide a custom AWS credential provider when the s
• Cannot set both proxyOptions and kmsConnectCallback
• Cannot set both proxyOptions and kmsConnectCallback
• Missing required option `keyVaultNamespace`
• Unable to complete creating data keys: ${cause.message}

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/daab19603ae2b884.json. Report an issue: GitHub.