Summary

The Go Driver's built-in MONGODB-AWS authenticator uses a hand-rolled, minimal AWS credential chain that cannot keep pace with the AWS ecosystem. Users cannot plug in the official AWS SDK v2 credential chain, meaning they cannot use modern AWS authentication mechanisms like EKS Pod Identity without workarounds.

We are trying to:

• Expose a stable interface in mongo/options so users can supply their own credential source.
• Ship an optional "ext/awsauth" submodule that wraps the AWS SDK v2 so users get the full AWS credential chain by simply passing cfg.Credentials from config.LoadDefaultConfig.

Motivation

Who is the affected end user?

Go driver users, for example, who want to use EKS Pod Identity, or who deploy services on AWS Lambda, where the runtime injects AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY automatically.

How does this affect the end user?

• The internal credential chain does not support newer AWS mechanisms (e.g., EKS Pod Identity and regional STS endpoints). Adding each new mechanism requires modifying the driver, which perpetually lags behind the AWS SDK.
• In environments where AWS credentials are injected automatically (AWS Lambda, EKS), the existing credential-fetching order makes it impossible for users to override credentials with a custom provider.
• Users who need advanced AWS features (e.g., EKS Pod Identity users) have raised multiple support cases (e.g., HELP-78444) that cannot be resolved without this work.
• The built-in SigV4 signing and credential-fetching code carries CVE risk: patches released by AWS in the SDK do not automatically apply to the driver.

How likely is it that this problem or use case will occur?

More of a main path than an edge case in the AWS environment. See HELP-78444 for example.

If the problem does occur, what are the consequences and how severe are they?

From a usability issue for users who are blocked from using Pod Identity or SDK-managed short-lived credentials, to a latent security risk, as the internal signing/credential code does not benefit from AWS SDK patches.

Is this issue urgent?

No, AFAIK.

Is this ticket required by a downstream team?

No, AFAIK.

Is this ticket only for tests?

No

Cast of Characters

Engineering Lead:
Document Author:
POCers:
Product Owner:
Program Manager:
Stakeholders:

Channels & Docs

Slack Channel

Scope Document

[Technical Design Document|some.url]