AWS IAM Authentication

Specify the Authentication Mechanism

You can specify the MONGODB-AWS authentication mechanism by using a connection string or a MongoCredential object. Select the Connection String or the MongoCredential tab below for corresponding instructions and sample code:

val mongoClient =
    MongoClient.create("mongodb://<atlasUri>?authMechanism=MONGODB-AWS")

val credential = MongoCredential.createAwsCredential(null, null)
val settings = MongoClientSettings.builder()
    .applyToClusterSettings { builder: ClusterSettings.Builder ->
        builder.hosts(
            listOf(ServerAddress("<atlasUri>"))
        )
    }
    .credential(credential)
    .build()
val mongoClient = MongoClient.create(settings)

Add the AWS SDK Dependency

To add the AWS SDK as a dependency to your project, see the following AWS documentation for the version you need:

• For the AWS SDK for Java v2, see the Setting Up guide.

• For the AWS SDK for Java v1, see the Getting Started guide.

Supply Your Credentials

To supply your credentials, see the following AWS documentation for the version you need:

• To learn more about the AWS SDK for Java v2 class the driver uses to get the credentials, see the DefaultCredentialsProvider API documentation.

  Learn how to supply your credentials to this class from the Use the default credential provider chain section.

• To learn more about the AWS SDK for Java v1 class the driver uses to get the credentials, see the DefaultAWSCredentialsProviderChain API documentation.

  Learn how to supply your credentials to this class from the Using the Default Credential Provider Chain section.

Specify the Authentication Mechanism

You can specify the MONGODB-AWS authentication mechanism by using a MongoCredential object or in the connection string.

To specify the authentication mechanism by using a MongoCredential object, call the MongoCredential.createAwsCredential() factory method and add the MongoCredential instance to your MongoClient, as shown in the following example:

val credential = MongoCredential.createAwsCredential(null, null)
val settings = MongoClientSettings.builder()
    .applyToClusterSettings { builder: ClusterSettings.Builder ->
        builder.hosts(
            listOf(ServerAddress("<atlasUri>"))
        )
    }
    .credential(credential)
    .build()
val mongoClient = MongoClient.create(settings)

To specify the MONGODB-AWS authentication mechanism in the connection string, add it as a parameter as shown in the following example:

val mongoClient =
    MongoClient.create("mongodb://<atlasUri>?authMechanism=MONGODB-AWS")

Set Environment Variables

This section shows how to provide your credentials by setting environment variables for the following types of authentication:

• Programmatic access keys

• ECS container credentials

• EC2 container credentials

The following example shows how you can set your programmatic access keys in environment variables by using bash or a similar shell:

export AWS_ACCESS_KEY_ID=<awsKeyId>
export AWS_SECRET_ACCESS_KEY=<awsSecretKey>
export AWS_SESSION_TOKEN=<awsSessionToken>

Omit the line that sets the AWS_SESSION_TOKEN variable if you don't need an AWS session token for that role.

To authenticate by using ECS container credentials, set the ECS endpoint relative URI in an environment variable by using bash or a similar shell, as shown in the following example:

export AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=<your ECS endpoint>

To authenticate by using EC2 container credentials, do not set the AWS environment variables. The driver obtains the credentials from the default IPv4 EC2 instance metadata endpoint.