GODRIVER-3567 Add optional AWS SDK v2-based MONGODB-AWS authenticator submodule - #2494
Merged
Merged
Conversation
github-actions
Bot
added
the
review-priority-normal
Contributor
API Change Report./v2/mongo/optionscompatible changes(*AutoEncryptionOptions).SetAWSCredentialsProvider: added ./v2/x/mongo/driver/mongocrypt/optionscompatible changesMongoCryptOptions.AWSCredentialsProvider: added |
Contributor
🧪 Performance ResultsCommit SHA: 61ace3aThe following benchmark tests for version 6a6213ab1b8f070007afbee6 had statistically significant changes (i.e., |z-score| > 1.96):
For a comprehensive view of all microbenchmark results for this PR's commit, please check out the Evergreen perf task for this patch. |
qingyang-hu
force-pushed
the
godriver3567awsauth
branch
16 times, most recently
from
July 22, 2026 22:54
84bc726 to
88dbbf2
Compare
qingyang-hu
force-pushed
the
godriver3567awsauth
branch
from
July 22, 2026 23:50
88dbbf2 to
bbedca6
Compare
qingyang-hu
commented
Jul 22, 2026
qingyang-hu
changed the title
qingyang-hu
marked this pull request as ready for review
July 23, 2026 12:38
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces an optional, AWS SDK v2-compatible way to supply custom AWS credentials into the driver’s MONGODB-AWS authentication flow (including CSFLE’s automatic KMS credential fetching), without making the AWS SDK a dependency of the core go.mongodb.org/mongo-driver/v2 module.
Changes:
- Adds a new public
options.AWSCredentialsProviderAPI (plusAWSCredentialsalias) and plumbs it through client auth + client-side encryption option types. - Implements internal adapters to bridge public providers to the driver’s internal AWS credentials provider interface, and wires provider precedence (URI creds > custom provider > env/default chain).
- Adds a new
ext/awsauthsubmodule (adapter for AWS SDK v2 providers), along with integration/tests/examples and compilecheck/CI plumbing.
Reviewed changes
Copilot reviewed 28 out of 31 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| x/mongo/driver/topology/topology_options.go | Bridges options.Credential into internal auth creds; now wires AWS credentials providers via internal adapter. |
| x/mongo/driver/mongocrypt/options/mongocrypt_options.go | Adds AWS credentials provider field to mongocrypt options for CSFLE KMS fetching. |
| x/mongo/driver/mongocrypt/mongocrypt.go | Passes custom AWS provider into CSFLE KMS credential fetching; errors if provider is set but automatic fetching isn’t configured. |
| x/mongo/driver/auth/mongodbaws_test.go | Adds unit-level coverage for provider precedence vs explicit creds. |
| Taskfile.yml | Updates compilecheck subtest regex target name. |
| mongo/options/clientoptions.go | Adds public AWSCredentialsProvider interface and AWSCredentials type alias; adds field to Credential. |
| mongo/options/clientencryptionoptions.go | Adds AWS provider to ClientEncryption options and builder setter. |
| mongo/options/autoencryptionoptions.go | Adds AWS provider to AutoEncryption options and setter. |
| mongo/client.go | Plumbs auto-encryption AWS provider into mongocrypt via internal adapter. |
| mongo/client_examples_test.go | Documents custom AWS credential provider precedence and adds a usage example. |
| mongo/client_encryption.go | Plumbs ClientEncryption AWS provider into mongocrypt via internal adapter. |
| internal/test/compilecheck/compile_check_test.go | Adds compilecheck case for ext/awsauth usage and reduces redundant compilation via shared GOCACHE volume. |
| internal/test/aws/aws_test.go | Adds integration tests validating custom provider auth + precedence over environment variables. |
| internal/integration/client_side_encryption_prose_test.go | Adds prose tests validating CSFLE behavior with custom AWS providers and error cases. |
| internal/credutil/aws_options_provider.go | New internal adapter from public options.AWSCredentialsProvider to internal AWS credentials provider interface. |
| internal/aws/credentials/credentials.go | Reorders credentials.Value fields to support direct struct conversions with AWS SDK credentials shapes. |
| go.work | Adds new ext/awsauth modules to the workspace. |
| ext/awsauth/test/go.sum | Adds dependency checksums for the ext module integration tests. |
| ext/awsauth/test/go.mod | Defines integration-test module for ext/awsauth using AWS SDK default chain. |
| ext/awsauth/test/aws_test.go | Adds ext-module integration test covering non-inline-URI scenarios via AWS SDK default credential chain. |
| ext/awsauth/go.sum | Adds checksums for the ext module dependencies. |
| ext/awsauth/go.mod | Defines new ext/awsauth module pinned to aws-sdk-go-v2 v1.28.0. |
| ext/awsauth/examples/go.sum | Adds checksums for the examples module dependencies. |
| ext/awsauth/examples/go.mod | Defines examples module for ext/awsauth. |
| ext/awsauth/examples/example_test.go | Adds example showing how to adapt AWS SDK default config credentials into the driver. |
| ext/awsauth/doc.go | Adds package documentation for the new ext/awsauth module. |
| ext/awsauth/awsauth.go | Implements the AWS SDK v2 credentials-provider adapter. |
| etc/run-mongodb-aws-test.sh | Extends AWS auth test runner to include ext/awsauth/test. |
| Dockerfile | Pre-downloads Go toolchains used by compilecheck to reduce runtime overhead. |
| .github/workflows/codeql.yml | Updates compilecheck subtest regex target name in CodeQL workflow. |
| .evergreen/config.yml | Ensures AWS ECS auth test task has appropriate AWS_TEST env. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
103
to
116
| var oidcMachineCallback auth.OIDCCallback | ||
| if cred.OIDCMachineCallback != nil { | ||
| if credOpts.OIDCMachineCallback != nil { | ||
| oidcMachineCallback = func(ctx context.Context, args *driver.OIDCArgs) (*driver.OIDCCredential, error) { | ||
| cred, err := cred.OIDCMachineCallback(ctx, convertOIDCArgs(args)) | ||
| return (*driver.OIDCCredential)(cred), err | ||
| credOpts, err := credOpts.OIDCMachineCallback(ctx, convertOIDCArgs(args)) | ||
| return (*driver.OIDCCredential)(credOpts), err | ||
| } | ||
| } | ||
|
|
||
| var oidcHumanCallback auth.OIDCCallback | ||
| if cred.OIDCHumanCallback != nil { | ||
| if credOpts.OIDCHumanCallback != nil { | ||
| oidcHumanCallback = func(ctx context.Context, args *driver.OIDCArgs) (*driver.OIDCCredential, error) { | ||
| cred, err := cred.OIDCHumanCallback(ctx, convertOIDCArgs(args)) | ||
| return (*driver.OIDCCredential)(cred), err | ||
| credOpts, err := credOpts.OIDCHumanCallback(ctx, convertOIDCArgs(args)) | ||
| return (*driver.OIDCCredential)(credOpts), err | ||
| } |
Comment on lines
+7
to
+22
| // This package allows credential providers and signers in AWS SDK v2 to be | ||
| // supplied to the MongoDB Go Driver for use with the MONGODB-AWS authentication | ||
| // mechanism. | ||
| // | ||
| // This package is a separate module to avoid adding the AWS SDK as a dependency | ||
| // of the main driver. Users who don't need AWS authentication won't need to | ||
| // import the AWS SDK. | ||
| // | ||
| // NewCredentialsProvider() adapts an AWS CredentialsProvider to be used in: | ||
| // | ||
| // ClientOptions | ||
| // ClientEncryptionOptions | ||
| // AutoEncryptionOptions | ||
| // | ||
| // ClientOptions | ||
| package awsauth |
Comment on lines
+27
to
+33
| // NewCredentialsProvider returns a CredentialsProvider that wraps AWS | ||
| // CredentialsProvider. CredentialsProvider is expected to not be nil. | ||
| func NewCredentialsProvider(credentialsProvider aws.CredentialsProvider) *CredentialsProvider { | ||
| return &CredentialsProvider{ | ||
| provider: credentialsProvider, | ||
| } | ||
| } |
prestonvasquez
enabled auto-merge (squash)
July 23, 2026 21:19
prestonvasquez
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GODRIVER-3567
GODRIVER-3615
Summary
This PR allows users to plug a custom AWS SDK v2 credentials provider into the driver's MONGODB-AWS authentication mechanism without forcing the AWS SDK as a dependency on the core driver.
Additionally, EKS Pod Identity and other AWS SDK-native authentication are made possible by the
ext/awsauthsubmodule as required in GODRIVER-3571.The custom provider overrides environment variables and all automatic sources, superseded only by explicit URI credentials as required in GODRIVER-3615.
Background & Motivation
This PR contains two stacked commits.
881bc5f:
New public interface in mongo/options (clientoptions.go)
AWSCredentialsProviderinterface (Retrieve(ctx) (AWSCredentials, error)) and anAWSCredentialsstruct alias.WSCredentialsProviderfield intoCredential, and intoClientEncryptionOptions/AutoEncryptionOptions.New
ext/awsauthsub moduleNewCredentialsProvider(aws.CredentialsProvider)adapts an AWS SDK v2 provider to the driver'soptions.AWSCredentialsProviderinterface. The adapter relies onAWSCredentialsbeing a struct type alias soaws.Credentialsconverts directly.Internal adapter (internal/credutil/aws_options_provider.go
AWSOptionsProviderbridges the publicoptions.AWSCredentialsProviderto the driver's internalcredentials.Providertype.bbedca6:
Notes
Instead of the v1.0.0 specified in the original design, the ext/awsauth submodule depends on aws-sdk-go-v2 v1.28.0 in this PR. v1.28.0 is the earliest version that is compatible with the current Credentials struct.