DRIVERS-2280 : Call mongocrypt_setopt_use_need_kms_credentials_state to opt in to handling the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state. Handle the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state. If the originally configured KMS providers have an empty aws: { }, attempt to obtain AWS credentials following the logic of Obtaining Credentials (excluding the URI section). Pass the new credentials back with mongocrypt_ctx_provide_kms_providers . A new CSFLE prose test is introduced in 5cf3ed7 . Please see the C driver implementation as a reference . Note: the C driver also supports a user-provided callback for KMS providers. That is not in scope of DRIVERS-2280 .