Troubleshoot MONGODB-AWS authentication in Liquibase

Error: SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target

Java uses its own certificate trust store and does not read tlsCAFile from the connection string. The AWS global certificate bundle must be imported into a JKS trust store before Liquibase can establish a TLS connection.

Fix: Complete Step 7 - DocumentDB only: Import the CA certificate bundle into a Java trust store in the authentication procedure to create the JKS trust store and set JAVA_TOOL_OPTIONS.

Error: MONGODB-AWS authentication could not start: no AWS credentials were found

AWS credentials set as environment variables only exist in the terminal session where they were set. If you set credentials in one terminal and run Liquibase in another, Liquibase cannot see them.

Fix: Set your AWS credentials and JAVA_TOOL_OPTIONS in the same terminal session where you run Liquibase. See Step 2 - Configure your AWS credentials in the authentication procedure.

Error: ChangeLogParseException: The file was not found in the configured search path

Liquibase looks for the changelog file in the directories set by --search-path. If the search path does not include the directory that contains your changelog, Liquibase cannot find the file.

Fix: Set --search-path to the directory that contains your changelog file, and pass --changelog-file as a path relative to that directory. See Step 9 - Confirm the connection is successful in the authentication procedure:

Error: MongoSocketOpenException: Exception opening socket - Connection refused

The SSM tunnel is not running or has timed out. Liquibase is trying to connect to localhost:27017 but nothing is forwarding that traffic to the DocumentDB cluster.

Fix: Check your tunnel terminal. If it is no longer showing Waiting for connections..., open a new terminal window, paste your AWS credentials into it, and restart the tunnel. See Step 5 - DocumentDB only: Open a network tunnel in the authentication procedure.

Error: The term \bin\keytool.exe is not recognized as the name of a cmdlet, function, script file, or operable program

JAVA_HOME is not set in the current terminal session. The trust store script uses JAVA_HOME to locate keytool.exe - if the variable is empty the path resolves to \bin\keytool.exe, which does not exist.

Fix: Set JAVA_HOME before running the script, then re-run Step 7 - DocumentDB only: Import the CA certificate bundle into a Java trust store in the authentication procedure:

Symptom: Liquibase fails to authenticate even though aws sts get-caller-identity succeeds and AWS_PROFILE is set to a valid SSO profile.

AWS IAM Identity Center (SSO) profiles require an interactive login step that the default AWS credential chain does not perform on its own. Stale credentials exported in an earlier terminal session can also shadow ~/.aws/credentials even after they expire.

Fix: Export short-lived credentials from the profile before running Liquibase, and unset any stale AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN values first. See Step 2 - Configure your AWS credentials in the authentication procedure.