@@ -955,10 +955,6 @@ Examples are provided below.
955
955
956
956
- mechanism_properties
957
957
958
- - AWS_SESSION_TOKEN
959
-
960
- Drivers MUST allow the user to specify an AWS session token for authentication with temporary credentials.
961
-
962
958
- AWS_CREDENTIAL_PROVIDER
963
959
964
960
An AWS [Custom Credential Provider](#custom-credential-providers) that returns AWS credentials. Drivers MAY allow
@@ -970,11 +966,10 @@ Examples are provided below.
970
966
Drivers will need AWS IAM credentials (an access key, a secret access key and optionally a session token) to complete
971
967
the steps in the
972
968
[Signature Version 4 Signing Process](https: // docs.aws.amazon.com/general/latest/gr/signature-version-4.html?shortFooter=true).
973
- If a username and password are provided drivers MUST use these for the AWS IAM access key and AWS IAM secret key,
974
- respectively . If , additionally, a session token is provided Drivers MUST use it as well . If a username is provided
975
- without a password (or vice- versa) or if * only* a session token is provided Drivers MUST raise an error . In other words,
976
- regardless of how Drivers obtain credentials the only valid combination of credentials is an access key ID and a secret
977
- access key or an access key ID , a secret access key and a session token.
969
+ Regardless of how Drivers obtain credentials the only valid combination of credentials is an access key ID and a secret
970
+ access key or an access key ID , a secret access key and a session token . These values MUST be present in the environment
971
+ or be retrieved via the optional AWS SDK . If credentials are provided in the URI or client options, the driver MUST
972
+ raise an error.
978
973
979
974
AWS recommends using an SDK to " take care of some of the heavy lifting necessary in successfully making API calls,
980
975
including authentication, retry behavior, and more" .
@@ -1011,11 +1006,10 @@ Drivers MAY expose API for default providers for the following scenarios when ap
1011
1006
1012
1007
The order in which Drivers MUST search for credentials is:
1013
1008
1014
- 1. The URI
1015
- 2. A custom AWS credential provider if the driver supports it.
1016
- 3. Environment variables
1017
- 4. Using `AssumeRoleWithWebIdentity` if `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` are set.
1018
- 5. The ECS endpoint if `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` is set. Otherwise, the EC2 endpoint.
1009
+ 1. A custom AWS credential provider if the driver supports it.
1010
+ 2. Environment variables
1011
+ 3. Using `AssumeRoleWithWebIdentity` if `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` are set.
1012
+ 4. The ECS endpoint if `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` is set. Otherwise, the EC2 endpoint.
1019
1013
1020
1014
> [!NOTE]
1021
1015
> See *Should drivers support accessing Amazon EC2 instance metadata in Amazon ECS* in [Q & A](#q-and-a)
@@ -1025,32 +1019,16 @@ The order in which Drivers MUST search for credentials is:
1025
1019
> description of `AssumeRole` below, which is distinct from `AssumeRoleWithWebIdentity` requests that are meant to be
1026
1020
> handled directly by the driver.
1027
1021
1028
- ##### URI
1029
-
1030
- An example URI for authentication with MONGODB-AWS using AWS IAM credentials passed through the URI is as follows:
1031
-
1032
- ```javascript
1033
- "mongodb://<access_key>:<secret_key>@mongodb.example.com/?authMechanism=MONGODB-AWS"
1034
- ```
1035
-
1036
- Users MAY have obtained temporary credentials through an
1037
- [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) request. If so, then in addition
1038
- to a username and password, users MAY also provide an `AWS_SESSION_TOKEN` as a `mechanism_property`.
1039
-
1040
- ```javascript
1041
- "mongodb://<access_key>:<secret_key>@mongodb.example.com/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:<security_token>"
1042
- ```
1043
-
1044
1022
##### Environment variables
1045
1023
1046
1024
AWS Lambda runtimes set several
1047
1025
[environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-runtime)
1048
1026
during initialization. To support AWS Lambda runtimes Drivers MUST check a subset of these variables, i.e.,
1049
1027
`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN`, for the access key ID, secret access key and
1050
- session token, respectively if AWS credentials are not explicitly provided in the URI. The `AWS_SESSION_TOKEN` may or
1051
- may not be set. However, if `AWS_SESSION_TOKEN` is set Drivers MUST use its value as the session token. Drivers
1052
- implemented in programming languages that support altering environment variables MUST always read environment variables
1053
- dynamically during authorization, to handle the case where another part the application has refreshed the credentials.
1028
+ session token, respectively. The `AWS_SESSION_TOKEN` may or may not be set. However, if `AWS_SESSION_TOKEN` is set
1029
+ Drivers MUST use its value as the session token. Drivers implemented in programming languages that support altering
1030
+ environment variables MUST always read environment variables dynamically during authorization, to handle the case where
1031
+ another part the application has refreshed the credentials.
1054
1032
1055
1033
However, if environment variables are not present during initial authorization, credentials may be fetched from another
1056
1034
source and cached. Even if the environment variables are present in subsequent authorization attempts, the driver MUST
@@ -2165,6 +2143,8 @@ practice to avoid this. (See
2165
2143
2166
2144
## Changelog
2167
2145
2146
+ - 2025-09-30: Remove support for explicitly specifying MONGODDB-AWS authentication properties.
2147
+
2168
2148
- 2025-09-10: Update precedence of MONGODB-AWS credential fetching behaviour.
2169
2149
2170
2150
- 2025-01-29: Add support for custom AWS credential providers.
0 commit comments