-
Type: New Feature
-
Resolution: Unresolved
-
Priority: Trivial - P5
-
None
-
Component/s: Authentication
-
None
-
Needed
-
(copied to CRM)
Per the current spec, MongoDB drivers currently resolve AWS credentials in the following order:
The order in which Drivers MUST search for credentials is:
- Credentials passed through the URI
- Environment variables
- ECS endpoint if and only if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set.
- EC2 endpoint
This flow is a slight deviation from how the AWS-SDK resolves credentials, which is roughly as follows:
- Environment variables
- The default credential profiles file– typically located at ~/.aws/credentials (location can vary per platform), and shared by many of the AWS SDKs and by the AWS CLI.
- ECS endpoint if the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set.
- EC2 endpoint
Because most AWS tooling that includes the AWS SDK follows this resolution, it was surprising to learn that ~/.aws/config was not supported.
As a frequent user of AWS services, I have many different named profiles within my AWS configuration that allows me to switch context when authenticating. Using a named profile also allows me to instrument custom process for obtaining credentials.
Because I could not use the ~/.aws/config file, I wrote a small Python3 library/CLI tool to fill that gap: https://mongodb-iam-connection-string.readthedocs.io/en/latest/readme.html
I think it would be beneficial to have drivers implement the same credential resolution chain to avoid incompatibility with usage that includes the ~/.aws/config file.
- related to
-
DRIVERS-2475 Consider Using AWS SDK for Auth
- Implementing