Summary

Remove support for specifying MONGODB-AWS authentication properties explicitly from both the connection string and MongoCredential constructor (or equivalent).  The end result would be an API like:

• Connection string: mongodb+srv://<host>/?authMechanism=MONGODB-AWS
• MongoCredential constructor: MongoCredential.createAwsCredential()

As with any breaking API change, the existing API would have to go through a deprecation cycle before it's removed.

Motivation

Who is the affected end user?

Application developers

How does this affect the end user?

Application developers are confused by the existing API, where accessKeyId, secretKey, and sessionToken can by explicitly specified in the connection string or MongoCredential constructor.  It's almost never what you want to do in a production setting, since almost everyone wants to use some sort of temporary, expirable credential, and specifying it explicitly doesn't allow for that.  The end result is that authentication initially succeeds, but when the session token expires, it starts to fail, and users are confused.  Then we have to explain to them about the AWS SDK, which they often aren't even aware of despite our documentation, and the result is an unhappy customer that has wasted a lot of time.

We've even seen cases where customers think they have to recycle their entire MongoClient every few minutes in order to use AWS authentication.

How likely is it that this problem or use case will occur?

Fairly likely

If the problem does occur, what are the consequences and how severe are they?

Loss of availability when the session token expires is the most likely consequence of mis-use of our current API.

Is this issue urgent?

Important but not urgent

Is this ticket required by a downstream team?

No

Is this ticket only for tests?

No

Acceptance Criteria

• Update drivers-evergreen-tools aws_tester.py to accept a new command line argument to not add credentials to the MONGODB_URI. This script when the parameter is set must put the credentials in environment variables. Note in the auth spec that drivers removing the URI credentials feature must update their CI to use the new argument.
• Update Spec:
  • Update credential fetching order for MONGODB-AWS in the auth spec to remove URI from the first spot.
  • Note in the URI section from the MONGODB-AWS auth section in the auth spec that it is no longer to be present.
  • Note that AWS_SESSION_TOKEN from auth mech properties in the MONGODB-AWS section in the auth spec is to be removed.
  • Add new URI tests for corresponding error conditions and note that drivers implementing this change must skip the legacy connection string auth specs where MONGODB-AWS with credentials are in the URI
• Add a note on drivers being able to choose how to deprecate the URI options and AWS_SESSION_TOKEN option in their manner of choosing.
• Create separate drivers ticket to remove the legacy URI MONGODB-AWS tests (DRIVERS-3297)
• Update the connection string/instruction given by the Atlas UI is (currently: mongodb+srv://<AWS access key>:<AWS secret key>@foo.mongodb.net/?authSource=%24external&authMechanism=MONGODB-AWS&retryWrites=true&w=majority&authMechanismProperties=AWS_SESSION_TOKEN:<session token (for AWS IAM Roles)>&appName=test-aws-connection-string).
• Update the authMechanism and authMechanismProperties documentation here: https://www.mongodb.com/docs/manual/reference/connection-string-options/#mongodb-urioption-urioption.authMechanism (DOCSP-54437)