Skip to content

Commit 2a83694

Browse files
authored
DRIVERS-3131: No explicitly provided properties with MONGODB-AWS (#1847)
1 parent ace53b1 commit 2a83694

File tree

4 files changed

+46
-50
lines changed

4 files changed

+46
-50
lines changed

source/auth/auth.md

Lines changed: 14 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -955,10 +955,6 @@ Examples are provided below.
955955
956956
- mechanism_properties
957957
958-
- AWS_SESSION_TOKEN
959-
960-
Drivers MUST allow the user to specify an AWS session token for authentication with temporary credentials.
961-
962958
- AWS_CREDENTIAL_PROVIDER
963959
964960
An AWS [Custom Credential Provider](#custom-credential-providers) that returns AWS credentials. Drivers MAY allow
@@ -970,11 +966,10 @@ Examples are provided below.
970966
Drivers will need AWS IAM credentials (an access key, a secret access key and optionally a session token) to complete
971967
the steps in the
972968
[Signature Version 4 Signing Process](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html?shortFooter=true).
973-
If a username and password are provided drivers MUST use these for the AWS IAM access key and AWS IAM secret key,
974-
respectively. If, additionally, a session token is provided Drivers MUST use it as well. If a username is provided
975-
without a password (or vice-versa) or if *only* a session token is provided Drivers MUST raise an error. In other words,
976-
regardless of how Drivers obtain credentials the only valid combination of credentials is an access key ID and a secret
977-
access key or an access key ID, a secret access key and a session token.
969+
Regardless of how Drivers obtain credentials the only valid combination of credentials is an access key ID and a secret
970+
access key or an access key ID, a secret access key and a session token. These values MUST be present in the environment
971+
or be retrieved via the optional AWS SDK. If credentials are provided in the URI or client options, the driver MUST
972+
raise an error.
978973

979974
AWS recommends using an SDK to "take care of some of the heavy lifting necessary in successfully making API calls,
980975
including authentication, retry behavior, and more".
@@ -1011,11 +1006,10 @@ Drivers MAY expose API for default providers for the following scenarios when ap
10111006
10121007
The order in which Drivers MUST search for credentials is:
10131008
1014-
1. The URI
1015-
2. A custom AWS credential provider if the driver supports it.
1016-
3. Environment variables
1017-
4. Using `AssumeRoleWithWebIdentity` if `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` are set.
1018-
5. The ECS endpoint if `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` is set. Otherwise, the EC2 endpoint.
1009+
1. A custom AWS credential provider if the driver supports it.
1010+
2. Environment variables
1011+
3. Using `AssumeRoleWithWebIdentity` if `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` are set.
1012+
4. The ECS endpoint if `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` is set. Otherwise, the EC2 endpoint.
10191013
10201014
> [!NOTE]
10211015
> See *Should drivers support accessing Amazon EC2 instance metadata in Amazon ECS* in [Q & A](#q-and-a)
@@ -1025,32 +1019,16 @@ The order in which Drivers MUST search for credentials is:
10251019
> description of `AssumeRole` below, which is distinct from `AssumeRoleWithWebIdentity` requests that are meant to be
10261020
> handled directly by the driver.
10271021
1028-
##### URI
1029-
1030-
An example URI for authentication with MONGODB-AWS using AWS IAM credentials passed through the URI is as follows:
1031-
1032-
```javascript
1033-
"mongodb://<access_key>:<secret_key>@mongodb.example.com/?authMechanism=MONGODB-AWS"
1034-
```
1035-
1036-
Users MAY have obtained temporary credentials through an
1037-
[AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) request. If so, then in addition
1038-
to a username and password, users MAY also provide an `AWS_SESSION_TOKEN` as a `mechanism_property`.
1039-
1040-
```javascript
1041-
"mongodb://<access_key>:<secret_key>@mongodb.example.com/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:<security_token>"
1042-
```
1043-
10441022
##### Environment variables
10451023
10461024
AWS Lambda runtimes set several
10471025
[environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-runtime)
10481026
during initialization. To support AWS Lambda runtimes Drivers MUST check a subset of these variables, i.e.,
10491027
`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN`, for the access key ID, secret access key and
1050-
session token, respectively if AWS credentials are not explicitly provided in the URI. The `AWS_SESSION_TOKEN` may or
1051-
may not be set. However, if `AWS_SESSION_TOKEN` is set Drivers MUST use its value as the session token. Drivers
1052-
implemented in programming languages that support altering environment variables MUST always read environment variables
1053-
dynamically during authorization, to handle the case where another part the application has refreshed the credentials.
1028+
session token, respectively. The `AWS_SESSION_TOKEN` may or may not be set. However, if `AWS_SESSION_TOKEN` is set
1029+
Drivers MUST use its value as the session token. Drivers implemented in programming languages that support altering
1030+
environment variables MUST always read environment variables dynamically during authorization, to handle the case where
1031+
another part the application has refreshed the credentials.
10541032
10551033
However, if environment variables are not present during initial authorization, credentials may be fetched from another
10561034
source and cached. Even if the environment variables are present in subsequent authorization attempts, the driver MUST
@@ -2165,6 +2143,8 @@ practice to avoid this. (See
21652143

21662144
## Changelog
21672145

2146+
- 2025-09-30: Remove support for explicitly specifying MONGODDB-AWS authentication properties.
2147+
21682148
- 2025-09-10: Update precedence of MONGODB-AWS credential fetching behaviour.
21692149

21702150
- 2025-01-29: Add support for custom AWS credential providers.

source/auth/tests/legacy/connection-string.json

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

source/auth/tests/legacy/connection-string.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,15 @@ tests:
320320
mechanism: MONGODB-AWS
321321
mechanism_properties:
322322
AWS_SESSION_TOKEN: token!@#$%^&*()_+
323+
- description: should throw an exception if username provided (MONGODB-AWS)
324+
uri: mongodb://[email protected]/?authMechanism=MONGODB-AWS
325+
valid: false
326+
- description: should throw an exception if username and password provided (MONGODB-AWS)
327+
uri: mongodb://user:[email protected]/?authMechanism=MONGODB-AWS
328+
valid: false
329+
- description: should throw an exception if AWS_SESSION_TOKEN provided (MONGODB-AWS)
330+
uri: mongodb://localhost/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:token
331+
valid: false
323332
- description: should recognise the mechanism with test environment (MONGODB-OIDC)
324333
uri: mongodb://localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:test
325334
valid: true

source/auth/tests/mongodb-aws.md

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,7 @@ Drivers MUST test the following scenarios:
1212
7. Caching of AWS credentials fetched by the driver.
1313

1414
For brevity, this section gives the values `<AccessKeyId>`, `<SecretAccessKey>` and `<Token>` in place of a valid access
15-
key ID, secret access key and session token (also known as a security token). Note that if these values are passed into
16-
the URI they MUST be URL encoded. Sample values are below.
15+
key ID, secret access key and session token (also known as a security token). Sample values are below.
1716

1817
```text
1918
AccessKeyId=AKIAI44QH8DHBEXAMPLE
@@ -37,14 +36,7 @@ directly from the custom provider instead of using the AWS SDK default provider.
3736

3837
### 2. Custom Credential Provider Authentication Precedence
3938

40-
#### Case 1: Credentials in URI Take Precedence
41-
42-
Create a `MongoClient` configured with AWS auth and credentials in the URI. Example:
43-
`mongodb://<AccessKeyId>:<SecretAccessKey>@localhost:27017/?authMechanism=MONGODB-AWS`
44-
45-
Configure a custom credential provider to pass valid AWS credentials. The provider must track if it was called.
46-
47-
Expect authentication to succeed and the custom credential provider was *not* called.
39+
#### Case 1: Credentials in URI Take Precedence *Removed*
4840

4941
#### Case 2: Custom Provider Takes Precedence Over Environment Variables
5042

@@ -59,11 +51,11 @@ Expect authentication to succeed and the custom credential provider was called.
5951

6052
## Regular credentials
6153

62-
Drivers MUST be able to authenticate by providing a valid access key id and secret access key pair as the username and
63-
password, respectively, in the MongoDB URI. An example of a valid URI would be:
54+
Drivers MUST be able to authenticate when a valid access key id and secret access key pair are present in the
55+
environment. Drivers MUST provide the --nouri option to aws_tester.py in drivers-evergreen-tools for this test.
6456

6557
```text
66-
mongodb://<AccessKeyId>:<SecretAccessKey>@localhost/?authMechanism=MONGODB-AWS
58+
mongodb://localhost/?authMechanism=MONGODB-AWS
6759
```
6860

6961
## EC2 Credentials
@@ -95,11 +87,11 @@ mongodb://localhost/?authMechanism=MONGODB-AWS
9587
## AssumeRole
9688

9789
Drivers MUST be able to authenticate using temporary credentials returned from an assume role request. These temporary
98-
credentials consist of an access key ID, a secret access key, and a security token passed into the URI. A sample URI
99-
would be:
90+
credentials consist of an access key ID, a secret access key, and a security token present in the environment. Drivers
91+
MUST provide the --nouri option to aws_tester.py in drivers-evergreen-tools for this test. A sample URI would be:
10092

10193
```text
102-
mongodb://<AccessKeyId>:<SecretAccessKey>@localhost/?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:<Token>
94+
mongodb://localhost/?authMechanism=MONGODB-AWS
10395
```
10496

10597
## Assume Role with Web Identity

0 commit comments

Comments
 (0)