From 9a47fcaa81572e2cf46e8e2f7413a8065b870cb2 Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Sun, 28 Sep 2025 21:07:47 +0200
Subject: [PATCH 01/14] feat(NODE-7046): remove AWS uri support

---
 .evergreen/setup-mongodb-aws-auth-tests.sh | 2 +-
 .gitmodules                                | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.evergreen/setup-mongodb-aws-auth-tests.sh b/.evergreen/setup-mongodb-aws-auth-tests.sh
index 0d91583d046..d26efc049b7 100644
--- a/.evergreen/setup-mongodb-aws-auth-tests.sh
+++ b/.evergreen/setup-mongodb-aws-auth-tests.sh
@@ -18,7 +18,7 @@ cd $DRIVERS_TOOLS/.evergreen/auth_aws
 # Create a python virtual environment.
 . ./activate-authawsvenv.sh
 # Source the environment variables. Configure the environment and the server.
-. aws_setup.sh $AWS_CREDENTIAL_TYPE
+. aws_setup.sh $AWS_CREDENTIAL_TYPE --nouri
 
 cd $BEFORE
 
diff --git a/.gitmodules b/.gitmodules
index d89986aa201..899222b5bca 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,4 @@
 [submodule "drivers-evergreen-tools"]
 	path = drivers-evergreen-tools
 	url = https://github.com/mongodb-labs/drivers-evergreen-tools.git
+	branch = DRIVERS-3131
\ No newline at end of file

From 5c6d9de8100537a7622602b87affdab14ec0465d Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 13:55:52 +0200
Subject: [PATCH 02/14] test: skip relevant tests

---
 test/unit/assorted/auth.spec.test.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/test/unit/assorted/auth.spec.test.ts b/test/unit/assorted/auth.spec.test.ts
index c474fd8cf11..0744a6451e7 100644
--- a/test/unit/assorted/auth.spec.test.ts
+++ b/test/unit/assorted/auth.spec.test.ts
@@ -1,6 +1,12 @@
 import { loadSpecTests } from '../../spec';
 import { executeUriValidationTest } from '../../tools/uri_spec_runner';
 
+const SKIP = [
+  'should throw an exception if username and no password (MONGODB-AWS)',
+  'should use username and password if specified (MONGODB-AWS)',
+  'should use username, password and session token if specified (MONGODB-AWS)'
+];
+
 describe('Auth option spec tests (legacy)', function () {
   const suites = loadSpecTests('auth', 'legacy');
 
@@ -8,6 +14,10 @@ describe('Auth option spec tests (legacy)', function () {
     describe(suite.name, function () {
       for (const test of suite.tests) {
         it(`${test.description}`, function () {
+          if (SKIP.includes(test.description)) {
+            this.test.skipReason = `NODE-7046: ${test.description}`;
+            this.test.skip();
+          }
           executeUriValidationTest(test);
         });
       }

From 28539cb17e57a6c7cf20bea099cd6a29c0c6fdeb Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 15:01:33 +0200
Subject: [PATCH 03/14] fix: arg placement

---
 .evergreen/setup-mongodb-aws-auth-tests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.evergreen/setup-mongodb-aws-auth-tests.sh b/.evergreen/setup-mongodb-aws-auth-tests.sh
index d26efc049b7..800d116e276 100644
--- a/.evergreen/setup-mongodb-aws-auth-tests.sh
+++ b/.evergreen/setup-mongodb-aws-auth-tests.sh
@@ -18,7 +18,7 @@ cd $DRIVERS_TOOLS/.evergreen/auth_aws
 # Create a python virtual environment.
 . ./activate-authawsvenv.sh
 # Source the environment variables. Configure the environment and the server.
-. aws_setup.sh $AWS_CREDENTIAL_TYPE --nouri
+. aws_setup.sh --nouri $AWS_CREDENTIAL_TYPE
 
 cd $BEFORE
 

From c6545f37e4bc8b93f21ccc819fd00249f8b2fa0a Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 15:26:42 +0200
Subject: [PATCH 04/14] chore: submodule update

---
 drivers-evergreen-tools                     |  2 +-
 test/spec/auth/legacy/connection-string.yml | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers-evergreen-tools b/drivers-evergreen-tools
index 3b3f081588c..78cabb250c7 160000
--- a/drivers-evergreen-tools
+++ b/drivers-evergreen-tools
@@ -1 +1 @@
-Subproject commit 3b3f081588cdd4b03be0bf1d6a293ed90a4ea9a4
+Subproject commit 78cabb250c7ee5a1a22e323cda86a5d2706ba1c1
diff --git a/test/spec/auth/legacy/connection-string.yml b/test/spec/auth/legacy/connection-string.yml
index 6b82ef42258..355c9894901 100644
--- a/test/spec/auth/legacy/connection-string.yml
+++ b/test/spec/auth/legacy/connection-string.yml
@@ -320,6 +320,18 @@ tests:
     mechanism: MONGODB-AWS
     mechanism_properties:
       AWS_SESSION_TOKEN: token!@#$%^&*()_+
+- description: should throw an exception if username provided (MONGODB-AWS)
+    implies default mechanism)
+  uri: mongodb://user:localhost.com/
+  valid: false
+- description: should throw an exception if username and password provided (MONGODB-AWS)
+    implies default mechanism)
+  uri: mongodb://user@pass:localhost.com/
+  valid: false
+- description: should throw an exception if AWS_SESSION_TOKEN provided (MONGODB-AWS)
+    implies default mechanism)
+  uri: mongodb://localhost/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:token
+  valid: false
 - description: should recognise the mechanism with test environment (MONGODB-OIDC)
   uri: mongodb://localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:test
   valid: true

From f68d8ef70e7b9f9df8b510e987c654063cff5fc1 Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 15:46:06 +0200
Subject: [PATCH 05/14] feat: throw if credentials set

---
 src/cmap/auth/mongo_credentials.ts           |  1 +
 src/cmap/auth/mongodb_aws.ts                 | 10 ++++------
 src/connection_string.ts                     | 12 ++++++++++++
 test/spec/auth/legacy/connection-string.json | 15 +++++++++++++++
 test/spec/auth/legacy/connection-string.yml  |  2 +-
 5 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/src/cmap/auth/mongo_credentials.ts b/src/cmap/auth/mongo_credentials.ts
index 9abe1ebbc5b..5030f8ebbdf 100644
--- a/src/cmap/auth/mongo_credentials.ts
+++ b/src/cmap/auth/mongo_credentials.ts
@@ -58,6 +58,7 @@ export interface AuthMechanismProperties extends Document {
   SERVICE_NAME?: string;
   SERVICE_REALM?: string;
   CANONICALIZE_HOST_NAME?: GSSAPICanonicalizationValue;
+  /** @internal */
   AWS_SESSION_TOKEN?: string;
   /** A user provided OIDC machine callback function. */
   OIDC_CALLBACK?: OIDCCallbackFunction;
diff --git a/src/cmap/auth/mongodb_aws.ts b/src/cmap/auth/mongodb_aws.ts
index d8bb29886da..27365640651 100644
--- a/src/cmap/auth/mongodb_aws.ts
+++ b/src/cmap/auth/mongodb_aws.ts
@@ -56,12 +56,10 @@ export class MongoDBAWS extends AuthProvider {
       );
     }
 
-    if (!authContext.credentials.username) {
-      authContext.credentials = await makeTempCredentials(
-        authContext.credentials,
-        this.credentialFetcher
-      );
-    }
+    authContext.credentials = await makeTempCredentials(
+      authContext.credentials,
+      this.credentialFetcher
+    );
 
     const { credentials } = authContext;
 
diff --git a/src/connection_string.ts b/src/connection_string.ts
index 97b7d4d62cc..f9087f197e8 100644
--- a/src/connection_string.ts
+++ b/src/connection_string.ts
@@ -423,6 +423,18 @@ export function parseOptions(
       );
     }
 
+    if (isAws) {
+      const { username, password } = mongoOptions.credentials;
+      if (username || password) {
+        throw new MongoParseError(
+          'username and password cannot be provided when using MONGODB-AWS'
+        );
+      }
+      if (mongoOptions.credentials.mechanismProperties.AWS_SESSION_TOKEN) {
+        throw new MongoParseError('AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS');
+      }
+    }
+
     mongoOptions.credentials.validate();
 
     // Check if the only auth related option provided was authSource, if so we can remove credentials
diff --git a/test/spec/auth/legacy/connection-string.json b/test/spec/auth/legacy/connection-string.json
index 3a099c81379..7582639566f 100644
--- a/test/spec/auth/legacy/connection-string.json
+++ b/test/spec/auth/legacy/connection-string.json
@@ -440,6 +440,21 @@
         }
       }
     },
+    {
+      "description": "should throw an exception if username provided (MONGODB-AWS) implies default mechanism)",
+      "uri": "mongodb://user:localhost.com/",
+      "valid": false
+    },
+    {
+      "description": "should throw an exception if username and password provided (MONGODB-AWS) implies default mechanism)",
+      "uri": "mongodb://user@pass:localhost.com/",
+      "valid": false
+    },
+    {
+      "description": "should throw an exception if AWS_SESSION_TOKEN provided (MONGODB-AWS) implies default mechanism)",
+      "uri": "mongodb://localhost/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:token",
+      "valid": false
+    },
     {
       "description": "should recognise the mechanism with test environment (MONGODB-OIDC)",
       "uri": "mongodb://localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:test",
diff --git a/test/spec/auth/legacy/connection-string.yml b/test/spec/auth/legacy/connection-string.yml
index 355c9894901..14c0fdd9e3f 100644
--- a/test/spec/auth/legacy/connection-string.yml
+++ b/test/spec/auth/legacy/connection-string.yml
@@ -480,4 +480,4 @@ tests:
     (MONGODB-OIDC)
   uri: mongodb://user:pass@localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:k8s
   valid: false
-  credential: null
\ No newline at end of file
+  credential: null

From 813cac402e91bca3cfb7888adcce9a4b7cee094b Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 16:07:58 +0200
Subject: [PATCH 06/14] fix: assume role

---
 .evergreen/config.yml                  | 16 ----------------
 .evergreen/generate_evergreen_tasks.js |  1 -
 drivers-evergreen-tools                |  2 +-
 3 files changed, 1 insertion(+), 18 deletions(-)

diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index b42c08070c0..8ed13f1e2f9 100644
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -1609,21 +1609,6 @@ tasks:
       - func: install dependencies
       - func: bootstrap mongo-orchestration
       - func: run tls tests
-  - name: aws-latest-auth-test-run-aws-auth-test-with-regular-aws-credentials
-    commands:
-      - command: expansions.update
-        type: setup
-        params:
-          updates:
-            - {key: VERSION, value: latest}
-            - {key: NODE_LTS_VERSION, value: '22'}
-            - {key: AUTH, value: auth}
-            - {key: ORCHESTRATION_FILE, value: auth-aws.json}
-            - {key: TOPOLOGY, value: server}
-      - func: install dependencies
-      - func: bootstrap mongo-orchestration
-      - func: assume secrets manager role
-      - func: run aws auth test with regular aws credentials
   - name: aws-latest-auth-test-run-aws-auth-test-with-assume-role-credentials
     commands:
       - command: expansions.update
@@ -3178,7 +3163,6 @@ buildvariants:
     expansions:
       NODE_LTS_VERSION: 22
     tasks:
-      - aws-latest-auth-test-run-aws-auth-test-with-regular-aws-credentials
       - aws-latest-auth-test-run-aws-auth-test-with-assume-role-credentials
       - aws-latest-auth-test-run-aws-auth-test-with-aws-EC2-credentials
       - aws-latest-auth-test-run-aws-auth-test-with-aws-credentials-as-environment-variables
diff --git a/.evergreen/generate_evergreen_tasks.js b/.evergreen/generate_evergreen_tasks.js
index 82449fb623f..a79761427d5 100644
--- a/.evergreen/generate_evergreen_tasks.js
+++ b/.evergreen/generate_evergreen_tasks.js
@@ -344,7 +344,6 @@ const AWS_AUTH_TASKS = [];
 for (const VERSION of AWS_AUTH_VERSIONS) {
   const name = ex => `aws-${VERSION}-auth-test-${ex.split(' ').join('-')}`;
   const awsFuncs = [
-    { func: 'run aws auth test with regular aws credentials' },
     { func: 'run aws auth test with assume role credentials' },
     { func: 'run aws auth test with aws EC2 credentials', onlySdk: true },
     { func: 'run aws auth test with aws credentials as environment variables' },
diff --git a/drivers-evergreen-tools b/drivers-evergreen-tools
index 78cabb250c7..89830b5b106 160000
--- a/drivers-evergreen-tools
+++ b/drivers-evergreen-tools
@@ -1 +1 @@
-Subproject commit 78cabb250c7ee5a1a22e323cda86a5d2706ba1c1
+Subproject commit 89830b5b10677aa78a9e40fc1e869ffb86cf7162

From 1c45bb24e29aca635ba73445e8e58b19e4d213d7 Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 16:15:11 +0200
Subject: [PATCH 07/14] test: bring back regular

---
 .evergreen/generate_evergreen_tasks.js | 1 +
 drivers-evergreen-tools                | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.evergreen/generate_evergreen_tasks.js b/.evergreen/generate_evergreen_tasks.js
index a79761427d5..82449fb623f 100644
--- a/.evergreen/generate_evergreen_tasks.js
+++ b/.evergreen/generate_evergreen_tasks.js
@@ -344,6 +344,7 @@ const AWS_AUTH_TASKS = [];
 for (const VERSION of AWS_AUTH_VERSIONS) {
   const name = ex => `aws-${VERSION}-auth-test-${ex.split(' ').join('-')}`;
   const awsFuncs = [
+    { func: 'run aws auth test with regular aws credentials' },
     { func: 'run aws auth test with assume role credentials' },
     { func: 'run aws auth test with aws EC2 credentials', onlySdk: true },
     { func: 'run aws auth test with aws credentials as environment variables' },
diff --git a/drivers-evergreen-tools b/drivers-evergreen-tools
index 89830b5b106..5fa39709dde 160000
--- a/drivers-evergreen-tools
+++ b/drivers-evergreen-tools
@@ -1 +1 @@
-Subproject commit 89830b5b10677aa78a9e40fc1e869ffb86cf7162
+Subproject commit 5fa39709dde92f78b3d3b7364757c3a5336096bb

From e6c0bfdae28f39eed972571f3f220e8cc95f0798 Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 16:21:43 +0200
Subject: [PATCH 08/14] test: regen config

---
 .evergreen/config.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 8ed13f1e2f9..b42c08070c0 100644
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -1609,6 +1609,21 @@ tasks:
       - func: install dependencies
       - func: bootstrap mongo-orchestration
       - func: run tls tests
+  - name: aws-latest-auth-test-run-aws-auth-test-with-regular-aws-credentials
+    commands:
+      - command: expansions.update
+        type: setup
+        params:
+          updates:
+            - {key: VERSION, value: latest}
+            - {key: NODE_LTS_VERSION, value: '22'}
+            - {key: AUTH, value: auth}
+            - {key: ORCHESTRATION_FILE, value: auth-aws.json}
+            - {key: TOPOLOGY, value: server}
+      - func: install dependencies
+      - func: bootstrap mongo-orchestration
+      - func: assume secrets manager role
+      - func: run aws auth test with regular aws credentials
   - name: aws-latest-auth-test-run-aws-auth-test-with-assume-role-credentials
     commands:
       - command: expansions.update
@@ -3163,6 +3178,7 @@ buildvariants:
     expansions:
       NODE_LTS_VERSION: 22
     tasks:
+      - aws-latest-auth-test-run-aws-auth-test-with-regular-aws-credentials
       - aws-latest-auth-test-run-aws-auth-test-with-assume-role-credentials
       - aws-latest-auth-test-run-aws-auth-test-with-aws-EC2-credentials
       - aws-latest-auth-test-run-aws-auth-test-with-aws-credentials-as-environment-variables

From cd6e6f72a39db1e9dc7816da6686ec757e344810 Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 16:33:49 +0200
Subject: [PATCH 09/14] test: aws handler

---
 test/integration/node-specific/examples/aws_handler.js | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/test/integration/node-specific/examples/aws_handler.js b/test/integration/node-specific/examples/aws_handler.js
index b22ce92bf5a..f0743b98ee3 100644
--- a/test/integration/node-specific/examples/aws_handler.js
+++ b/test/integration/node-specific/examples/aws_handler.js
@@ -6,10 +6,6 @@ const { MongoClient } = require('mongodb');
 // options. Note that MongoClient now auto-connects so no need to store the connect()
 // promise anywhere and reference it.
 const client = new MongoClient(process.env.MONGODB_URI, {
-  auth: {
-    username: process.env.AWS_ACCESS_KEY_ID,
-    password: process.env.AWS_SECRET_ACCESS_KEY
-  },
   authSource: '$external',
   authMechanism: 'MONGODB-AWS'
 });

From b5aaf290d0c1910e275226a1a9f0ca3bdbbc4cfd Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Tue, 30 Sep 2025 17:07:06 +0200
Subject: [PATCH 10/14] chore: submodule

---
 .gitmodules             | 3 +--
 drivers-evergreen-tools | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.gitmodules b/.gitmodules
index 899222b5bca..6c55e340790 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,4 +1,3 @@
 [submodule "drivers-evergreen-tools"]
 	path = drivers-evergreen-tools
-	url = https://github.com/mongodb-labs/drivers-evergreen-tools.git
-	branch = DRIVERS-3131
\ No newline at end of file
+	url = https://github.com/mongodb-labs/drivers-evergreen-tools.git
\ No newline at end of file
diff --git a/drivers-evergreen-tools b/drivers-evergreen-tools
index 5fa39709dde..fca0ac532b8 160000
--- a/drivers-evergreen-tools
+++ b/drivers-evergreen-tools
@@ -1 +1 @@
-Subproject commit 5fa39709dde92f78b3d3b7364757c3a5336096bb
+Subproject commit fca0ac532b85a24d9ceae9478976733b40bfca30

From 4b8c7d40c3b97b2322f26e102df88a8ea7cc90c5 Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Mon, 6 Oct 2025 15:08:53 -0400
Subject: [PATCH 11/14] test: sync

---
 test/spec/auth/legacy/connection-string.json | 10 +++++-----
 test/spec/auth/legacy/connection-string.yml  |  7 ++-----
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/test/spec/auth/legacy/connection-string.json b/test/spec/auth/legacy/connection-string.json
index 7582639566f..a32aa80ea48 100644
--- a/test/spec/auth/legacy/connection-string.json
+++ b/test/spec/auth/legacy/connection-string.json
@@ -441,17 +441,17 @@
       }
     },
     {
-      "description": "should throw an exception if username provided (MONGODB-AWS) implies default mechanism)",
-      "uri": "mongodb://user:localhost.com/",
+      "description": "should throw an exception if username provided (MONGODB-AWS)",
+      "uri": "mongodb://user@localhost.com/",
       "valid": false
     },
     {
-      "description": "should throw an exception if username and password provided (MONGODB-AWS) implies default mechanism)",
-      "uri": "mongodb://user@pass:localhost.com/",
+      "description": "should throw an exception if username and password provided (MONGODB-AWS)",
+      "uri": "mongodb://user:pass@localhost.com/",
       "valid": false
     },
     {
-      "description": "should throw an exception if AWS_SESSION_TOKEN provided (MONGODB-AWS) implies default mechanism)",
+      "description": "should throw an exception if AWS_SESSION_TOKEN provided (MONGODB-AWS)",
       "uri": "mongodb://localhost/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:token",
       "valid": false
     },
diff --git a/test/spec/auth/legacy/connection-string.yml b/test/spec/auth/legacy/connection-string.yml
index 14c0fdd9e3f..2cf01bfb798 100644
--- a/test/spec/auth/legacy/connection-string.yml
+++ b/test/spec/auth/legacy/connection-string.yml
@@ -321,15 +321,12 @@ tests:
     mechanism_properties:
       AWS_SESSION_TOKEN: token!@#$%^&*()_+
 - description: should throw an exception if username provided (MONGODB-AWS)
-    implies default mechanism)
-  uri: mongodb://user:localhost.com/
+  uri: mongodb://user@localhost.com/
   valid: false
 - description: should throw an exception if username and password provided (MONGODB-AWS)
-    implies default mechanism)
-  uri: mongodb://user@pass:localhost.com/
+  uri: mongodb://user:pass@localhost.com/
   valid: false
 - description: should throw an exception if AWS_SESSION_TOKEN provided (MONGODB-AWS)
-    implies default mechanism)
   uri: mongodb://localhost/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:token
   valid: false
 - description: should recognise the mechanism with test environment (MONGODB-OIDC)

From 22caa48e5b26617e04b56ee411776b297588cf87 Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Mon, 6 Oct 2025 15:58:32 -0400
Subject: [PATCH 12/14] chore: comments

---
 src/connection_string.ts             | 8 +++++---
 test/unit/assorted/auth.spec.test.ts | 3 +--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/connection_string.ts b/src/connection_string.ts
index f9087f197e8..7e33806183a 100644
--- a/src/connection_string.ts
+++ b/src/connection_string.ts
@@ -426,12 +426,14 @@ export function parseOptions(
     if (isAws) {
       const { username, password } = mongoOptions.credentials;
       if (username || password) {
-        throw new MongoParseError(
-          'username and password cannot be provided when using MONGODB-AWS'
+        throw new MongoAPIError(
+          'username and password cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'
         );
       }
       if (mongoOptions.credentials.mechanismProperties.AWS_SESSION_TOKEN) {
-        throw new MongoParseError('AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS');
+        throw new MongoAPIError(
+          'AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'
+        );
       }
     }
 
diff --git a/test/unit/assorted/auth.spec.test.ts b/test/unit/assorted/auth.spec.test.ts
index 0744a6451e7..0c6d734a86c 100644
--- a/test/unit/assorted/auth.spec.test.ts
+++ b/test/unit/assorted/auth.spec.test.ts
@@ -2,7 +2,6 @@ import { loadSpecTests } from '../../spec';
 import { executeUriValidationTest } from '../../tools/uri_spec_runner';
 
 const SKIP = [
-  'should throw an exception if username and no password (MONGODB-AWS)',
   'should use username and password if specified (MONGODB-AWS)',
   'should use username, password and session token if specified (MONGODB-AWS)'
 ];
@@ -15,7 +14,7 @@ describe('Auth option spec tests (legacy)', function () {
       for (const test of suite.tests) {
         it(`${test.description}`, function () {
           if (SKIP.includes(test.description)) {
-            this.test.skipReason = `NODE-7046: ${test.description}`;
+            this.test.skipReason = `NODE-7228: ${test.description}`;
             this.test.skip();
           }
           executeUriValidationTest(test);

From 349827bea2f563929de9557271ff10a985718f8e Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Mon, 6 Oct 2025 18:09:33 -0400
Subject: [PATCH 13/14] test: fix tests

---
 test/spec/auth/legacy/connection-string.json | 4 ++--
 test/spec/auth/legacy/connection-string.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/spec/auth/legacy/connection-string.json b/test/spec/auth/legacy/connection-string.json
index a32aa80ea48..8982b61d5ae 100644
--- a/test/spec/auth/legacy/connection-string.json
+++ b/test/spec/auth/legacy/connection-string.json
@@ -442,12 +442,12 @@
     },
     {
       "description": "should throw an exception if username provided (MONGODB-AWS)",
-      "uri": "mongodb://user@localhost.com/",
+      "uri": "mongodb://user@localhost.com/?authMechanism=MONGODB-AWS",
       "valid": false
     },
     {
       "description": "should throw an exception if username and password provided (MONGODB-AWS)",
-      "uri": "mongodb://user:pass@localhost.com/",
+      "uri": "mongodb://user:pass@localhost.com/?authMechanism=MONGODB-AWS",
       "valid": false
     },
     {
diff --git a/test/spec/auth/legacy/connection-string.yml b/test/spec/auth/legacy/connection-string.yml
index 2cf01bfb798..2b98f0f8f2a 100644
--- a/test/spec/auth/legacy/connection-string.yml
+++ b/test/spec/auth/legacy/connection-string.yml
@@ -321,10 +321,10 @@ tests:
     mechanism_properties:
       AWS_SESSION_TOKEN: token!@#$%^&*()_+
 - description: should throw an exception if username provided (MONGODB-AWS)
-  uri: mongodb://user@localhost.com/
+  uri: mongodb://user@localhost.com/?authMechanism=MONGODB-AWS
   valid: false
 - description: should throw an exception if username and password provided (MONGODB-AWS)
-  uri: mongodb://user:pass@localhost.com/
+  uri: mongodb://user:pass@localhost.com/?authMechanism=MONGODB-AWS
   valid: false
 - description: should throw an exception if AWS_SESSION_TOKEN provided (MONGODB-AWS)
   uri: mongodb://localhost/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:token

From 21ca884a5b9246c47e518622b5a4ee51c5c8489b Mon Sep 17 00:00:00 2001
From: Durran Jordan <durran@gmail.com>
Date: Mon, 6 Oct 2025 18:15:33 -0400
Subject: [PATCH 14/14] chore: submmodule

---
 drivers-evergreen-tools | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers-evergreen-tools b/drivers-evergreen-tools
index fca0ac532b8..1dcbfe40545 160000
--- a/drivers-evergreen-tools
+++ b/drivers-evergreen-tools
@@ -1 +1 @@
-Subproject commit fca0ac532b85a24d9ceae9478976733b40bfca30
+Subproject commit 1dcbfe4054590022e93df4e059545eef95af2782