mongodb/node-mongodb-native · error · MongoCryptInvalidArgumentError

Can only provide a custom AWS credential provider when the s

Error message

Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching

What it means

Thrown by AutoEncrypter constructor (MongoCryptInvalidArgumentError) when credentialProviders.aws is set AND kmsProviders.aws is not empty. The custom AWS credential provider callback is only valid when the state machine is configured for automatic AWS credential fetching, i.e. when kmsProviders.aws is absent/empty so the driver knows to call the provider.

Source

Thrown at src/client-side-encryption/auto_encrypter.ts:264

    this._client = client;
    this._bypassEncryption = options.bypassAutoEncryption === true;

    this._keyVaultNamespace = options.keyVaultNamespace || 'admin.datakeys';
    this._keyVaultClient = options.keyVaultClient || client;
    this._metaDataClient = options.metadataClient || client;
    this._proxyOptions = options.proxyOptions || {};
    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {
      throw new MongoCryptInvalidArgumentError(
        'Cannot set both proxyOptions and kmsConnectCallback'
      );
    }
    this._tlsOptions = options.tlsOptions || {};
    this._kmsConnectCallback = options.kmsConnectCallback;
    this._kmsProviders = options.kmsProviders || {};
    this._credentialProviders = options.credentialProviders;

    if (options.credentialProviders?.aws && !isEmptyCredentials('aws', this._kmsProviders)) {
      throw new MongoCryptInvalidArgumentError(
        'Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching'
      );
    }

    const mongoCryptOptions: MongoCryptOptions = {
      errorWrapper: defaultErrorWrapper
    };
    if (options.schemaMap) {
      if (ByteUtils.isUint8Array(options.schemaMap)) {
        mongoCryptOptions.schemaMap = options.schemaMap;
      } else {
        mongoCryptOptions.schemaMap = serialize(options.schemaMap);
      }
    }

    if (options.encryptedFieldsMap) {
      if (ByteUtils.isUint8Array(options.encryptedFieldsMap)) {
        mongoCryptOptions.encryptedFieldsMap = options.encryptedFieldsMap;

View on GitHub (pinned to 3366c21a63)

Solutions

If you want the callback to supply AWS credentials, set kmsProviders.aws = {} (empty) so isEmptyCredentials returns true.
If you want static credentials, remove credentialProviders.aws.
Use isEmptyCredentials('aws', kmsProviders) in your own config builder to verify the combination before constructing the client.

Example fix

// before
autoEncryption: {
  kmsProviders: { aws: { accessKeyId, secretAccessKey } },
  credentialProviders: { aws: awsProvider }
}

// after
autoEncryption: {
  kmsProviders: { aws: {} },
  credentialProviders: { aws: awsProvider }
}

Defensive patterns

Strategy: validation

Validate before calling

function validateAwsProvider(opt) {
  const awsEmpty = opt.kmsProviders?.aws == null || Object.keys(opt.kmsProviders.aws).length === 0;
  if (opt.credentialProviders?.aws && !awsEmpty)
    throw new Error('Remove kmsProviders.aws when using credentialProviders.aws');
}

Type guard

type AwsCreds =
  | { kmsProviders: { aws: Record<string, never> }; credentialProviders: { aws: () => Promise<any> } }
  | { kmsProviders: { aws: { accessKeyId: string; secretAccessKey: string } }; credentialProviders?: undefined };

Try / catch

try { new MongoClient(uri, { autoEncryption: opt }); }
catch (err) {
  if (err instanceof MongoCryptInvalidArgumentError && /automatic AWS credential fetching/.test(err.message)) {
    /* set kmsProviders.aws = {} and retry */
  } else throw err;
}

Prevention

When introducing credentialProviders.aws, blank out kmsProviders.aws.
Use isEmptyCredentials('aws', kmsProviders) as a config sanity check.
Document which CSFLE credentialing style each environment uses.

When it happens

Trigger: Providing both autoEncryption.kmsProviders.aws = { accessKeyId, secretAccessKey } and autoEncryption.credentialProviders.aws = asyncProvider at the same time.

Common situations: Static credentials in config plus a rotation/refresh callback; transitioning from static creds to dynamic fetching without clearing kmsProviders.aws; copy-pasting examples that include both.

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/edab17b85107ebfb.json. Report an issue: GitHub.