feat(NODE-7046)!: remove AWS uri/options support #4689

durran · 2025-09-28T19:08:06Z

Description

Removes the ability to provide credentials when using MONGODB-AWS authentication.

Summary of Changes

Updates drivers tools to get the --nouri option for aws_tester.py
Sets up CI environments without credentials in the MONGODB_URI
Skips no longer relevant legacy auth tests.
Adds new tests in the legacy auth tests for testing error conditions
Removes support for providing credentials in the URI or options when auth mech is MONGODB-AWS.

Notes for Reviewers

I made AWS_SESSION_TOKEN internal instead of removing it completely as we still use that object and property internally when fetching credentials.

What is the motivation for this change?

NODE-7046/DRIVERS-3131

Release Highlight

Explicitly Provided Credentials No Longer Accepted With MONGODB-AWS Authentication

AWS environments (such as AWS Lambda) do not have credentials that are permanent and expire within a set amount of time. Providing credentials in the URI or options would mandate that those credentials would be valid for the life of the MongoClient, which is problematic. With this change, the installed required AWS SDK will now fetch credentials using the environment, endpoints, or a custom credential provider.

This means that for AWS authentication, all client URIs MUST now be specified as:

import { MongoClient } from 'mongodb';

const client = new MongoClient('mongodb<+srv>://<host>:<port>/?authMechanism=MONGODB-AWS');

Double check the following

Lint is passing (npm run check:lint)
Self-review completed using the steps outlined here
PR title follows the correct format: type(NODE-xxxx)[!]: description
- Example: feat(NODE-1234)!: rewriting everything in coffeescript
Changes are covered by tests
New TODOs have a related JIRA ticket

src/connection_string.ts

test/spec/auth/legacy/connection-string.json

test/spec/auth/legacy/connection-string.yml

test/unit/assorted/auth.spec.test.ts

dariakp · 2025-10-08T21:14:11Z

test/integration/node-specific/examples/aws_handler.js


 // Get the URI for the cluster then set AWS_ACCESS_KEY_ID as the username in the
 // URI and AWS_SECRET_ACCESS_KEY as the password, then set the appropriate auth
 // options. Note that MongoClient now auto-connects so no need to store the connect()


I think we need to update the text in the comments to talk about doing this via env vars instead

dariakp · 2025-10-08T21:15:45Z

src/connection_string.ts

+      const { username, password } = mongoOptions.credentials;
+      if (username || password) {
+        throw new MongoAPIError(
+          'username and password cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'


Suggested change

'username and password cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'

'username and password cannot be provided directly when using MONGODB-AWS. Credentials must be read via the AWS SDK'

I'm hesitant to accept this change as the addition of the word "directly" to me indicates that a username and password could be provided in another fashion. In the case of AWS authentication username and password do not really apply in any form. Same with the comment on the other error message.

Open to different phrasing, but I wanted to make sure that we differentiate between the valid and invalid manner of providing the credentials, "via the sdk" isn't really actionable for users, so perhaps something along the lines "in a manner that can be read by the AWS SDK" and/or "via environment variables or a custom credential provider". Does that make sense?

dariakp · 2025-10-08T21:15:56Z

src/connection_string.ts

+      }
+      if (mongoOptions.credentials.mechanismProperties.AWS_SESSION_TOKEN) {
+        throw new MongoAPIError(
+          'AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'


Suggested change

'AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'

'AWS_SESSION_TOKEN cannot be provided directly when using MONGODB-AWS. Credentials must be read via the AWS SDK'

dariakp · 2025-10-08T21:26:21Z

.evergreen/setup-mongodb-aws-auth-tests.sh

 . ./activate-authawsvenv.sh
 # Source the environment variables. Configure the environment and the server.
-. aws_setup.sh $AWS_CREDENTIAL_TYPE
+. aws_setup.sh --nouri $AWS_CREDENTIAL_TYPE


is there some logging we can add that confirms that the aws_tester.py is correctly running with that option set? I think the current version of the script here should be passing something in, but currently nothing is printing in the run (e.g. here)

We could file a ticket to update the tools script to log this, but it would be obvious if the option was set or not given the tests. In this PR if the option wasn't set the driver would be throwing an error since MONGODB_URI would have the credentials set. (But we don't want to log what our URIs are in CI or we redact them)

I think it would be useful to do this anyway for debugging purposes in the future - can you go ahead and file the corresponding ticket?

dariakp · 2025-10-08T21:43:26Z

test/unit/assorted/auth.spec.test.ts

 import { loadSpecTests } from '../../spec';
 import { executeUriValidationTest } from '../../tools/uri_spec_runner';

+const SKIP = [


I don't have a good file to comment on, but I was looking for changes to the prose tests, and noticed that our prose tests don't follow the convention - the relevant tests for this are in mongodb_aws.test.ts, where I think we can delete the Case 1 block. Can we move the prose tests from that file to mongodb_aws.prose.test?

feat(NODE-7046): remove AWS uri support

9a47fca

durran force-pushed the NODE-7046 branch from a6e9398 to 9a47fca Compare September 30, 2025 11:41

durran added 10 commits September 30, 2025 13:55

test: skip relevant tests

5c6d9de

fix: arg placement

28539cb

chore: submodule update

c6545f3

feat: throw if credentials set

f68d8ef

fix: assume role

813cac4

test: bring back regular

1c45bb2

test: regen config

e6c0bfd

test: aws handler

cd6e6f7

chore: submodule

b5aaf29

Merge branch 'main' into NODE-7046

b842edc

durran changed the title ~~feat(NODE-7046): remove AWS uri support~~ feat(NODE-7046): remove AWS uri/options support Sep 30, 2025

durran mentioned this pull request Sep 30, 2025

DRIVERS-3131: No explicitly provided properties with MONGODB-AWS mongodb/specifications#1847

Merged

4 tasks

durran marked this pull request as ready for review September 30, 2025 16:39

durran requested a review from a team as a code owner September 30, 2025 16:39

durran mentioned this pull request Oct 1, 2025

chore(deps): bump drivers-evergreen-tools from 3b3f081 to fca0ac5 #4698

Closed

dariakp self-assigned this Oct 1, 2025

dariakp added the Primary Review In Review with primary reviewer, not yet ready for team's eyes label Oct 1, 2025

dariakp requested changes Oct 1, 2025

View reviewed changes

durran added 2 commits October 6, 2025 15:08

test: sync

4b8c7d4

chore: comments

22caa48

durran requested a review from dariakp October 6, 2025 20:00

durran added 3 commits October 6, 2025 18:09

test: fix tests

349827b

chore: submmodule

21ca884

refactor: back to internal

53274dc

durran changed the title ~~feat(NODE-7046): remove AWS uri/options support~~ feat(NODE-7046)!: remove AWS uri/options support Oct 7, 2025

Merge branch 'main' into NODE-7046

fe3959d

dariakp requested changes Oct 8, 2025

View reviewed changes

	'username and password cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'
	'username and password cannot be provided directly when using MONGODB-AWS. Credentials must be read via the AWS SDK'

	'AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be read via the AWS SDK'
	'AWS_SESSION_TOKEN cannot be provided directly when using MONGODB-AWS. Credentials must be read via the AWS SDK'

feat(NODE-7046)!: remove AWS uri/options support #4689

Are you sure you want to change the base?

feat(NODE-7046)!: remove AWS uri/options support #4689

Uh oh!

Conversation

durran commented Sep 28, 2025 • edited by dariakp Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Summary of Changes

Notes for Reviewers

What is the motivation for this change?

Release Highlight

Explicitly Provided Credentials No Longer Accepted With MONGODB-AWS Authentication

Double check the following

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dariakp Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

durran commented Sep 28, 2025 •

edited by dariakp

Loading

dariakp Oct 8, 2025 •

edited

Loading