mongodb/node-mongodb-native · error · MongoAWSError

${error.message}

Error message

${error.message}

What it means

Thrown by the AWS temporary-credentials helper when the underlying AWS SDK credential provider (env vars, shared ini, SSO, web identity, EC2/ECS IMDS) rejects. The driver wraps the cause in a MongoAWSError whose message is the underlying provider's error.message. It occurs while obtaining the temporary credentials the driver uses for the MONGODB-AWS mechanism.

Source

Thrown at src/cmap/auth/aws_temporary_credentials.ts:126

     * Creates a credential provider that will attempt to find credentials from the
     * following sources (listed in order of precedence):
     *
     * - Environment variables exposed via process.env
     * - SSO credentials from token cache
     * - Web identity token credentials
     * - Shared credentials and config ini files
     * - The EC2/ECS Instance Metadata Service
     */
    try {
      const creds = await this.provider();
      return {
        AccessKeyId: creds.accessKeyId,
        SecretAccessKey: creds.secretAccessKey,
        Token: creds.sessionToken,
        Expiration: creds.expiration
      };
    } catch (error) {
      throw new MongoAWSError(error.message, { cause: error });
    }
  }
}

View on GitHub (pinned to dce7939f86)

Solutions

1. Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and optional AWS_SESSION_TOKEN) in the environment, or provide a valid ~/.aws/credentials profile.
2. If using an EC2/ECS role, verify the task/instance role is attached and IMDS is reachable (169.254.169.254).
3. For SSO, run `aws sso login` to refresh the short-lived token.
4. Read the wrapped error.message — it usually states exactly which provider failed and why (e.g. 'Could not load credentials from any providers').

Example fix

# before: no AWS credentials anywhere
export AWS_ACCESS_KEY_ID=''
# after
export AWS_ACCESS_KEY_ID='AKIA...'
export AWS_SECRET_ACCESS_KEY='...'
export AWS_SESSION_TOKEN='...' # if using STS

function hasAwsCredentials() {
  return Boolean(
    process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY
  ) || fs.existsSync(path.join(os.homedir(), '.aws', 'credentials'));
}
if (!hasAwsCredentials()) throw new Error('No AWS credentials found for MONGODB-AWS');

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoAWSError) {
    // read e.message (the wrapped provider error) to identify which provider failed
  }
  throw e;
}

When it happens

Trigger: AWS auth configured but no valid credentials discoverable: no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars, no ~/.aws/credentials, and the host is not an EC2/ECS role host; the EC2 IMDS endpoint is unreachable; STS AssumeRoleWithWebIdentity failed; shared ini file malformed.

Common situations: Running locally without AWS creds configured; ARN role assumption failing due to missing permission; ECS task role not yet available at startup; expired SSO login; ~/.aws/credentials referencing a profile that doesn't exist.

Related errors

• Could not obtain temporary MONGODB-AWS credentials
• Username required for mechanism '${this.mechanism}'
• AuthContext must provide credentials.
• Can only provide a custom AWS credential provider when the s
• Can only provide a custom AWS credential provider when the s

AI-assisted analysis of mongodb/node-mongodb-native@dce7939f86 (2026-08-11). Data as JSON: /api/errors/7b85019913623932. Report an issue: GitHub.