Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(DRIVERS-2903): use custom aws configuration #1743

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

feat(DRIVERS-2903): use custom aws configuration #1743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
21e1e1f
feat(DRIVERS-2903): use custom aws configuration
durran Jan 13, 2025
debefa3
Update source/auth/auth.md
durran Jan 30, 2025
b2a50f9
Update source/auth/auth.md
durran Jan 30, 2025
b50e2e3
fix: lint
durran Jan 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions source/auth/auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -987,6 +987,22 @@ those credentials will be used by default if AWS auth environment variables are
application. Alternatively, you can create an AWS profile specifically for your MongoDB credentials and set the
`AWS_PROFILE` environment variable to that profile name."

##### Custom Credential Providers

Drivers that choose to use the AWS SDK to fetch credentials MAY also allow users to provide a custom credential provider
as an option to the `MongoClient`. The interface for the option provided depends on the individual language SDK and
drivers MUST consult AWS SDK documentation to determine that format when implementing. The name of the option MUST be
`AWS_CREDENTIAL_PROVIDER` and be part of the authentication mechanism properties options that can be provided to the
client.

Drivers that implement this MAY choose to implement the following scenarios when applicable in their language's SDK:

1. The default SDK credential provider.
2. A custom credential provider chain.
3. A single credential provider of any available SDK options provided by the SDK.

##### Credential Fetching Order

The order in which Drivers MUST search for credentials is:

1. The URI
Expand Down Expand Up @@ -1306,6 +1322,10 @@ in the MONGODB-OIDC specification, including sections or blocks that specificall
check MUST be performed after SRV record resolution, if applicable. This property is only required for drivers
that support the [Human Authentication Flow](#human-authentication-flow).

- AWS_CREDENTIAL_PROVIDER

A function or object from the AWS SDK that can be used to return AWS credentials.

<span id="built-in-provider-integrations"/>

#### Built-in OIDC Environment Integrations
Expand Down Expand Up @@ -2134,6 +2154,8 @@ practice to avoid this. (See

## Changelog

- 2025-01-29: Add support for custom AWS credential providers.

- 2024-10-02: Add Kubernetes built-in OIDC provider integration.

- 2024-08-19: Clarify Reauthentication and Speculative Authentication combination behavior.
Expand Down
4 changes: 4 additions & 0 deletions source/auth/tests/mongodb-aws.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,10 @@ SecretAccessKey=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Token=AQoDYXdzEJr...<remainder of security token>
```

If the driver supports user provided custom AWS credential providers, then the driver MUST also test the above scenarios
2-6 with a user provided `AWS_CREDENTIAL_PROVIDER` auth mechanism property. This value MUST be the default credential
provider from the AWS SDK. If the default provider does not cover all scenarios above, those not covered MAY be skipped.

## Regular credentials

Drivers MUST be able to authenticate by providing a valid access key id and secret access key pair as the username and
Expand Down
Loading