What causes "Could not obtain temporary MONGODB-AWS credentials" in mongodb/node-mongodb-native?

Verify AWS env vars are non-empty: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN for temp creds).

mongodb/node-mongodb-native · error · MongoMissingCredentialsError

Could not obtain temporary MONGODB-AWS credentials

Error message

Could not obtain temporary MONGODB-AWS credentials

What it means

Thrown when the AWS credential provider chain returned a result, but that result is missing the AccessKeyId or SecretAccessKey fields (src/cmap/auth/mongodb_aws.ts:143). The driver attempted to build MongoCredentials from temporary credentials and found them incomplete. Surfaced as a MongoMissingCredentialsError.

Source

Thrown at src/cmap/auth/mongodb_aws.ts:144

    const saslContinue = {
      saslContinue: 1,
      conversationId: saslStartResponse.conversationId,
      payload: BSON.serialize(payload, bsonOptions)
    };

    await connection.command(ns(`${db}.$cmd`), saslContinue, undefined);
  }
}

async function makeTempCredentials(
  credentials: MongoCredentials,
  awsCredentialFetcher: AWSSDKCredentialProvider
): Promise<MongoCredentials> {
  function makeMongoCredentialsFromAWSTemp(creds: AWSTempCredentials) {
    // The AWS session token (creds.Token) may or may not be set.
    if (!creds.AccessKeyId || !creds.SecretAccessKey) {
      throw new MongoMissingCredentialsError('Could not obtain temporary MONGODB-AWS credentials');
    }

    return new MongoCredentials({
      username: creds.AccessKeyId,
      password: creds.SecretAccessKey,
      source: credentials.source,
      mechanism: AuthMechanism.MONGODB_AWS,
      mechanismProperties: {
        AWS_SESSION_TOKEN: creds.Token
      }
    });
  }
  const temporaryCredentials = await awsCredentialFetcher.getCredentials();

  return makeMongoCredentialsFromAWSTemp(temporaryCredentials);
}

function deriveRegion(host: string) {

View on GitHub (pinned to 3366c21a63)

Solutions

Verify AWS env vars are non-empty: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN for temp creds).
If using a custom credential provider via the driver option, ensure it resolves an object with both accessKeyId and secretAccessKey.
Re-authenticate SSO ('aws sso login') or refresh the web-identity token if using role assumption.
Confirm the EC2/ECS instance metadata service is reachable and the attached role has permission to be assumed.

Defensive patterns

Strategy: validation

Validate before calling

async function assertAwsCredsComplete(): Promise<void> {
  // Use the same provider chain the driver uses
  const { fromNodeProviderChain } = await import('@aws-sdk/credential-providers');
  const provider = fromNodeProviderChain();
  const creds = await provider();
  if (!creds?.accessKeyId || !creds?.secretAccessKey) {
    throw new Error('AWS provider chain returned incomplete credentials');
  }
}
await assertAwsCredsComplete();

Try / catch

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoMissingCredentialsError && /temporary MONGODB-AWS credentials/.test(e.message)) {
    // Refresh SSO / re-assume role / check instance metadata
    throw new Error('AWS temp credentials incomplete - refresh SSO or check IAM role.');
  }
  throw e;
}

Prevention

Pre-flight check: resolve the AWS provider chain at app startup.
For SSO, run 'aws sso login' before starting the app.
When passing a custom AWSCredentialProvider, ensure it always resolves accessKeyId and secretAccessKey.

When it happens

Trigger: The AWS SDK's fromNodeProviderChain() resolved to a provider that yielded an object without accessKeyId/secretAccessKey (e.g. a partial web-identity or SSO token, or a custom AWSCredentialProvider returning an empty object). Triggered inside makeTempCredentials after getCredentials() returns.

Common situations: A custom AWSCredentialProvider passed to MongoClient that returns incomplete data, an expired or partial SSO login, a web-identity token role assumption that silently failed and returned empty, or environment variables set to empty strings.

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/660d60282aeb9050.json. Report an issue: GitHub.