Authentication Mechanisms

Specify Your AWS IAM Credentials

You can supply your AWS IAM credentials on a MongoClientSettings object either by using a MongoCredential object or as part of the connection string. Select the Connection String or MongoCredential tab to see the corresponding syntax for specifying your credentials:

var connectionString = "mongodb+srv://<awsKeyId>:<awsSecretKey>@<hostname>[:<port>]?authSource=$external&authMechanism=MONGODB-AWS";
var mongoClientSettings = MongoClientSettings.FromConnectionString(connectionString);
var client = new MongoClient(mongoClientSettings);

var connectionString = "mongodb+srv://<awsKeyId>:<awsSecretKey>@<hostname>[:<port>]?authSource=$external&authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:<awsSessionToken>";

var mongoClientSettings = MongoClientSettings.FromConnectionString("mongodb+srv://<hostname>[:<port>]");
mongoClientSettings.Credential = new MongoCredential("MONGODB-AWS", new MongoExternalIdentity("<awsKeyId>"), new PasswordEvidence("<awsSecretKey>"));
var client = new MongoClient(mongoClientSettings);

mongoClientSettings.Credential = new MongoCredential("MONGODB-AWS", new MongoExternalIdentity("<awsKeyId>"), new PasswordEvidence("<awsSecretKey>"))
    .WithMechanismProperty("AWS_SESSION_TOKEN", "<awsSessionToken>");

Retrieve Credentials Automatically

Instead of specifying your AWS IAM credentials in MongoClientSettings, you can instruct the .NET/C# Driver to use the AWS SDK to automatically retrieve your credentials from an external source. To instruct the driver to retrieve your credentials, perform the following actions:

• Specify MONGODB-AWS as the authentication mechanism

• Specify that the authentication source is external to MongoDB

• Set your credentials in the appropriate location

You can specify the authentication mechanism and source either by using a MongoCredential object or as part of the connection string. Select the Connection String or MongoCredential tab to see the corresponding syntax for specifying the MONGODB-AWS authentication mechanism and external authentication source:

var connectionString = "mongodb+srv://<hostname>[:<port>]?authMechanism=MONGODB-AWS&authSource=$external";
var mongoClientSettings = MongoClientSettings.FromConnectionString(connectionString);
var client = new MongoClient(mongoClientSettings);

var mongoClientSettings = MongoClientSettings.FromConnectionString("mongodb+srv://<hostname>[:<port>]");
mongoClientSettings.Credential = new MongoCredential("MONGODB-AWS", new MongoExternalAwsIdentity(), new ExternalEvidence());
var client = new MongoClient(mongoClientSettings);

After you specify the authentication mechanism and source, you must set your credentials in the location appropriate to the credential type. The .NET/C# Driver checks for credentials in the following locations in the order listed here:

• Web identity provider

• Shared AWS credentials file

• Environment variables

• ECS container credentials

• EC2 container credentials

You can use an OpenID Connect (OIDC)-compatible web identity provider to authenticate to Amazon Elastic Kubernetes Service (EKS) or other services. To use a web identity provider, create a file that contains your OIDC token, then set the absolute path to this file in an environment variable by using bash or a similar shell as shown in the following example:

export AWS_WEB_IDENTITY_TOKEN_FILE=<absolute path to file containing your OIDC token>

To authenticate by using a profile in a shared AWS credentials file, you can use a text editor, the AWS SDK for .NET, or the AWS CLI to create the appropriate credential file.

To retrieve credentials directly from environment variables, set the following environment variables by using bash or a similar shell:

export AWS_ACCESS_KEY_ID=<awsKeyId>
export AWS_SECRET_ACCESS_KEY=<awsSecretKey>
export AWS_SESSION_TOKEN=<awsSessionToken>

To authenticate by using ECS container credentials, set the URI of your ECS endpoint in an environment variable by using bash or a similar shell. Select the Full ECS URI or Relative ECS URI tab to see the syntax for specifying the corresponding environment variable:

export AWS_CONTAINER_CREDENTIALS_FULL_URI=<full ECS endpoint>

export AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=<relative ECS endpoint>

To authenticate by using EC2 container credentials, make sure none of the environment variables mentioned earlier are set. The driver obtains the credentials from the default IPv4 EC2 instance metadata endpoint.