Authenticating to MongoDB Atlas with AWS IAM roles

[hdodov]

Using IAM roles is the most secure way to connect to Atlas and I want to document it in the docs and submit a PR, but I don't know where I should put it.

In short, the role should be attached to the EC2 or Lambda resource and the username and password should be removed from the connection string, while authSource and authMechanism are added, like this:

mongodb+srv://mongo.example.com/?authSource=$external&authMechanism=MONGODB-AWS&retryWrites=true&w=majority

Adding it here https://payloadcms.com/docs/getting-started/installation under mongoURL doesn't seem right. This is a more advanced and obscure use case, which shouldn't be right in the face of users at the "getting started" phase.

Where could I put such a thing?

[hdodov]

I've also managed to authenticate Amazon S3 for the storage plugin with IAM roles as well. I'd document that too.

[kalon-robson]

Payload's documentation already references to extending the mongoose connection options here: https://payloadcms.com/docs/getting-started/installation#server under the mongoOptions.

With https://mongoosejs.com/docs/connections.html#options being hyperlinked for further reading.

Is there a reason why you think the Mongoose documentation may not be sufficient?

[hdodov]

I don't understand. I'm not talking about Mongoose options at all, nor did I have to use them to achieve what I'm talking about.

When I make a Payload app, I'll want to host it somewhere. Atlas is the most popular MongoDB provider, while AWS is one of the leading cloud providers. It'd be great if I can google "payload host on aws and atlas" and find out how to do it. I wouldn't even guess to search for Mongoose.

Perhaps what I'm talking about shouldn't go directly in the docs, but rather be some sort of a guide, or a "recipe". Maybe I could write up a post for the blog? Is the blog version-controlled? I can't find it in the repo.

[denolfe]

I hear what both of you are saying. While we want to provide good documentation on the Payload side of things, we want to be very careful about polluting the docs with ancillary things like how to manage and deploy a database properly - as that is a very slippery slope.

We've talked about having some sort of "guides" section of the docs. It sounds like this may be a great first candidate for that - or we should add more sections to the deployment docs.

Let me get with the team on this and make a decision on where something like this should reside.

[hdodov]

@denolfe sounds great! Let me know if I can be useful. I could write up a draft of what I did, which you could then edit however you wish.

[denolfe]

@hdodov If you'd like to do a write-up in Markdown and post it here, I think that'd be useful for the time being - until we have the guides section up and going.

I'll convert this to a Discussion as well 👍