RUST-1529 Use AWS SDK to get credentials #1435

JamieTsai1024 · 2025-07-24T22:21:46Z

Replace existing implementation for getting AWS credentials by using the AWS SDK.

Currently, we have 5 places where we search for AWS credentials:

The MongoDB URI
Environment variables
~~A custom AWS credential provider if the driver supports it~~
STS AssumeRole or AssumeRoleWithWebIdentity
The ECS or EC2 endpoint

Testing

For the sake of testing, the existing implementation was replaced instead of being hidden behind a feature flag.

Methods 1-4 were tested locally. Clone https://github.com/isabelatkinson/drivers-evergreen-tools/tree/local-aws and run the following commands:

./.evergreen/run-aws-auth.sh

cd .evergreen/auth_aws
# run this script to reconfigure the type of AWS authentication to use
# copy the block of unset and export commands output by the script and run them in the terminal window you're using to run the driver tests
./aws_setup.sh (regular | env-creds | assume-role | session-creds | web-identity)

cd ~/mongo-rust-driver 
# Run the unset and set export commands printed by `./aws_setup.sh` for environment variables 
cargo nextest run auth_aws --features aws-auth

Work to be done for RUST-1529

Generate signature using AWS SDK (compute_authorization_header(...))
Determine feature flags required
- May restore deleted implementation from this PR, depending on whether we want to keep the AWS SDK as an optional dependency or replace the original non-SDK implementation entirely

…th feature flag

…ature flag

isabelatkinson

I forgot to mention this regarding the testing commit I provided, but we should leave line 226 (patchable: false) in config.yml commented out while this PR is being worked on. patchable: false disables tests from running on every commit to a pull request branch - normally, we don't need to run the AWS authentication tests that frequently, but since we're making AWS-related changes we should be running the tests on this PR.

Cargo.toml

src/client/auth/aws.rs

isabelatkinson · 2025-07-25T21:47:13Z

src/client/auth/aws.rs

-    let aws_credential = {
-        // Limit scope of this variable to avoid holding onto the lock for the duration of
-        // authenticate_stream.
-        let cached_credential = CACHED_CREDENTIAL.lock().await;


Does the SDK handle credential caching? We should make sure the new implementation still caches credentials as outlined in the spec

Following up on this — as we discussed, the SDK does implement credential caching. I’ve linked the relevant documentation here in case it's helpful for future reference!

src/client/auth/aws.rs

…redential_types::Credential

isabelatkinson

sorry if some of my comments are duplicated! the github UI was being weird

src/action/csfle/create_data_key.rs

src/test/csfle/on_demand_aws.rs

src/test/auth/aws.rs

src/test/csfle/on_demand_aws.rs

Cargo.toml

src/action/csfle/create_data_key.rs

src/client/auth/aws.rs

…ngo-rust-driver into RUST-1529-no-ff

isabelatkinson

LGTM! tagging Abraham for review, and then once he approves you can remove the patchable: false change in .evergreen/config.yml

Cargo.toml

abr-egn · 2025-07-31T14:45:44Z

src/client/auth/aws.rs

@@ -246,6 +300,21 @@ impl AwsCredential {
        }
    }

+    // Creates AwsCredential from keys.
+    fn from_sdk_creds(


Maybe have this take a Credentials instead?

Will do! Just as a heads-up, the code for from_sdk_creds will be removed in my next PR when I switch to the AWS SDK for SigV4 signing, so I didn’t prioritize cleaning it up too much. That said, your suggestion is definitely cleaner! :)

abr-egn

LGTM!

JamieTsai1024 and others added 13 commits July 23, 2025 12:30

Wip - add path for authentication using MongoDB URI behind aws-sdk-au…

bb11533

…th feature flag

Get auth credentials through env variables using AWS SDK

3d78f80

test URI/environment variable credentials

1f4c590

Add conditional imports for aws_config modules behind aws-sdk-auth fe…

6fe85bc

…ature flag

Try to pin aws_sdk dependency versions to fix tests

b6e1d9a

Merge branch 'main' into RUST-1529-no-ff

18c3bc8

Remove aws-sdk-auth ff

915b087

fix dependencies for MSRV

f5a65af

Merge branch 'main' into RUST-1529-no-ff

e2a5080

Fix lint on AwsCredential unused fields

cf3f3a5

Fix lint

8df943f

Uncomment tests

6b9d129

Revert comments in config.yml

e99fff2

JamieTsai1024 marked this pull request as ready for review July 25, 2025 20:45

JamieTsai1024 requested a review from a team as a code owner July 25, 2025 20:45

JamieTsai1024 requested a review from isabelatkinson July 25, 2025 20:45

Clean up comments

73d3a82

isabelatkinson reviewed Jul 25, 2025

View reviewed changes

JamieTsai1024 added 10 commits July 26, 2025 11:45

Remove unused imports and replace expect

dd94b48

Make dependencies optional and comment back patchable: false

e10a3ba

Move get credentials logic to a public method

f365624

Change return type of get_aws_credentials from AwsCredential to aws_c…

408ca2f

…redential_types::Credential

Fix lint and imports

f528c00

Move import behind aws-auth feature flag

678cdcb

Add logs

90d5156

Add logs

eac9bcf

Add default-https-client and rt-tokio to aws-config dependencies

cb26899

Comment out tests for credential caching

725d373

JamieTsai1024 requested a review from isabelatkinson July 29, 2025 17:16

Merge branch 'main' into RUST-1529-no-ff

b4c06e8

JamieTsai1024 and others added 3 commits July 29, 2025 13:52

Update Cargo.lock

46e171d

Fix cargo.lock

0cd8dfa

revert unneeded changes in cargo.lock

a482936

isabelatkinson reviewed Jul 29, 2025

View reviewed changes

JamieTsai1024 added 5 commits July 30, 2025 09:56

Uncomment and add ignore tags, remove dbg logs

2416644

Merge branch 'RUST-1529-no-ff' of https://github.com/JamieTsai1024/mo…

ee4f602

…ngo-rust-driver into RUST-1529-no-ff

Remove comment

6890532

Exclude aws-sdk-sts from Cargo.toml, add it manually during MSRV check

f2a4a62

Move aws sdk credential getting logic after original commented impl

c64a610

JamieTsai1024 requested a review from isabelatkinson July 30, 2025 15:46

JamieTsai1024 mentioned this pull request Jul 30, 2025

RUST-1529 Use AWS SDK for sigv4 signing #1438

Merged

isabelatkinson previously approved these changes Jul 30, 2025

View reviewed changes

isabelatkinson requested a review from abr-egn July 30, 2025 20:33

abr-egn reviewed Jul 31, 2025

View reviewed changes

Change return type of from_sdk_creds, add deps: to Cargo.toml

0ad2cc4

JamieTsai1024 dismissed isabelatkinson’s stale review via 0ad2cc4 July 31, 2025 15:20

JamieTsai1024 requested review from abr-egn and isabelatkinson July 31, 2025 15:23

abr-egn previously approved these changes Jul 31, 2025

View reviewed changes

Revert patchable: false comment

c5f9109

JamieTsai1024 dismissed abr-egn’s stale review via c5f9109 July 31, 2025 15:34

JamieTsai1024 added 2 commits July 31, 2025 13:18

Merge branch 'main' into RUST-1529-no-ff

85e7f88

Fix Cargo.lock version for aws-config

aaed4ca

isabelatkinson approved these changes Aug 1, 2025

View reviewed changes

JamieTsai1024 merged commit c95787f into mongodb:main Aug 1, 2025
17 of 20 checks passed

RUST-1529 Use AWS SDK to get credentials #1435

RUST-1529 Use AWS SDK to get credentials #1435

Uh oh!

Conversation

JamieTsai1024 commented Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing

Work to be done for RUST-1529

Uh oh!

isabelatkinson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

isabelatkinson Jul 25, 2025

Choose a reason for hiding this comment

Uh oh!

JamieTsai1024 Jul 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

isabelatkinson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

isabelatkinson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

abr-egn Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

JamieTsai1024 Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

abr-egn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

JamieTsai1024 commented Jul 24, 2025 •

edited

Loading