kevin.mas@mongodb.com - following up on COMPASS-11097. Thanks for the fix in 1.51.0 (#8443). It covers credentials read from the shared credentials/config files, but MONGODB-AWS still fails when the credential chain reaches the SSO provider, with the same class of error:

MongoAWSError: nt is not a function
    at i.getCredentials (file:///app/main/resources/app.asar/build/9108.c0f4823721fe39c04fae.renderer.js:1:278578)
    at async file:///app/main/resources/app.asar/build/9108.c0f4823721fe39c04fae.renderer.js:1:95253
    at async m.auth (file:///app/main/resources/app.asar/build/9108.c0f4823721fe39c04fae.renderer.js:1:94889)
    at async E (file:///app/main/resources/app.asar/build/9108.c0f4823721fe39c04fae.renderer.js:1:421554)
    at async t.connect (file:///app/main/resources/app.asar/build/9108.c0f4823721fe39c04fae.renderer.js:1:419067)

Steps to reproduce

1. Have an AWS CLI SSO profile as the default profile in ~/.aws/config (sso_start_url / sso_region / sso_account_id / sso_role_name; no static keys, no ~/.aws/credentials file) and a valid SSO session (aws sso login; aws sts get-caller-identity succeeds).
2. In Compass 1.51.0, connect with Authentication = AWS IAM (mongodb+srv://<cluster>/?authMechanism=MONGODB-AWS&authSource=$external), leaving Access Key ID / Secret Access Key / Session Token blank.
3. Connect.

Expected

Compass resolves temporary credentials from the SSO profile via the AWS SDK credential chain and authenticates.

Actual

SRV resolution, TLS and server discovery succeed (primary found), then the connection fails immediately with MongoAWSError: nt is not a function. Reproduced on two consecutive attempts.

Root cause (traced in the 1.51.0 bundle)

This looks like the same issue fixed in #8443, but in a different module:

• #8443 aliased @smithy/core/config to its node build, because the browser build stubs parseKnownFiles with a non-callable sentinel.
• With an SSO profile, the chain goes on to @aws-sdk/client-sso. Its node runtimeConfig calls emitWarningIfUnsupportedVersion(process.version), imported from @aws-sdk/core/client.
• @aws-sdk/core/client is also resolved to its browser build in the renderer bundle (packages-internal/core/src/submodules/client/index.browser.ts), where emitWarningIfUnsupportedVersion (and state, crtAvailability) are exported as Symbol.for("node-only").
• In build/8896.6ef8fde6e64c40edf83b.renderer.js: const it=Symbol.for("node-only"),nt=it,rt=it, and later in the SSO client config: nt(process.version). That call throws "nt is not a function".

The new e2e test (aws-iam-credential-chain.test.ts) writes static keys to a fake credentials file, so the chain resolves them with fromIni and never reaches the SSO provider. That is why this path wasn't caught.

Suggested fix

• Add a similar node-build alias for @aws-sdk/core/client in webpack-config-compass (and check the other @aws-sdk/ / @smithy/ submodules that export node-only stubs in their browser builds).
• Extend the e2e credential-chain test with an SSO profile (for example a fake sso-cache token plus a mocked portal endpoint), so this provider is covered too.

Workaround

Run aws configure export-credentials and paste the key ID, secret and session token into Compass's AWS IAM fields. This bypasses the credential chain, but the session token expires, so it has to be repeated.

Related: COMPASS-11097 (closed as fixed in 1.51.0).