mongodb · prestonvasquez · Jul 23, 2026 · Jul 14, 2026 · Jul 17, 2026 · Jul 23, 2026
@@ -468,6 +468,8 @@ functions:
       type: test
       params:
         binary: "bash"
+        env:
+          AWS_TEST: ecs
         include_expansions_in_env: [SKIP_ECS_AUTH_TEST]
         args: [*task-runner, evg-test-aws-ecs]
   run-aws-auth-test-with-aws-web-identity-credentials:

@@ -52,7 +52,7 @@ jobs:
           go build ./...
           go test -short -run ^$$ ./...
 
-          go test -v ./internal/test/compilecheck -run '^TestCompileCheck/go:1\.19$'
+          go test -v ./internal/test/compilecheck -run '^TestCompileCheck/main_driver/go:1\.19$'
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4.37.0 #immutable
         with:

@@ -47,6 +47,17 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 # Install taskfile
 RUN go install github.com/go-task/task/v3/cmd/task@v3.39.2
 
+# Pre-download the Go toolchains used by internal/test/compilecheck so the
+# compile check does not download them at runtime (the largest cost of that
+# test). The parent Go can fetch and run older toolchain modules, and a single
+# linux-amd64 toolchain per version cross-compiles for every GOARCH. Placed
+# before "COPY . /mongo-go-driver" so repo changes don't invalidate this layer.
+# Keep this list in sync with the GoVersions in
+# internal/test/compilecheck/compile_check_test.go.
+RUN for v in 1.19.0 1.20.0 1.21.0 1.22.0 1.23.0 1.24.0 1.25.0; do \
+      GOTOOLCHAIN=go$v go version; \
+    done
+
 COPY etc/docker_entry.sh /root/docker_entry.sh
 COPY --from=libmongocrypt /root/install /root/install
 

@@ -23,7 +23,7 @@ tasks:
     dir: internal/test/compilecheck
     cmds:
       - go mod download
-      - GOTOOLCHAIN=auto go test -v -run '^TestCompileCheck/go:1\.19$'
+      - GOTOOLCHAIN=auto go test -v -run '^TestCompileCheck/main_driver/go:1\.19$'
   build-compile-check-all: bash etc/run-compile-check-test.sh
   build-aws-ecs-test: go test -c ./internal/test/aws -o aws.testbin
   check-fmt:

@@ -32,3 +32,8 @@ set -x
 # For Go 1.16+, Go builds requires a go.mod file in the current working directory or a parent
 # directory. Spawn a new subshell, "cd" to the project directory, then run "go run".
 (cd ${PROJECT_DIRECTORY} && go test -timeout 30m -v ./internal/test/aws/... | tee -a test.suite)
+
+# Also run the ext/awsauth integration test, which uses the AWS SDK default credential
+# chain to cover scenarios where credentials are not embedded in the URI (EC2, ECS,
+# WebIdentity) in addition to the inline-credential scenarios.
+(cd ${PROJECT_DIRECTORY}/ext/awsauth/test && go test -timeout 30m -v ./... | tee -a test.suite)
@@ -0,0 +1,50 @@
+// Copyright (C) MongoDB, Inc. 2017-present.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License. You may obtain
+// a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+package awsauth
+
+import (
+	"context"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+)
+
+// CredentialsProvider adapts an AWS SDK v2 CredentialsProvider to the
+// options.AWSCredentialsProvider interface used by the MongoDB Go Driver.
+//
+// CredentialsProvider is expected to implement the options.AWSCredentialsProvider interface:
+//
+// import "go.mongodb.org/mongo-driver/v2/mongo/options"
+// var _ options.AWSCredentialsProvider = (*CredentialsProvider)(nil)
+type CredentialsProvider struct {
+	provider aws.CredentialsProvider
+}
+
+// NewCredentialsProvider returns a CredentialsProvider that wraps the provided
+// AWS SDK v2 CredentialsProvider. credentialsProvider must not be nil.
+func NewCredentialsProvider(credentialsProvider aws.CredentialsProvider) *CredentialsProvider {
+	return &CredentialsProvider{
+		provider: credentialsProvider,
+	}
+}
+
+// AWSCredentials is a struct that contains AWS credentials information.
+type AWSCredentials = struct {
+	AccessKeyID     string
+	SecretAccessKey string
+	SessionToken    string
+	Source          string
+	CanExpire       bool
+	Expires         time.Time
+	AccountID       string
+}
+
+// Retrieve returns the credentials.
+func (p *CredentialsProvider) Retrieve(ctx context.Context) (AWSCredentials, error) {
+	creds, err := p.provider.Retrieve(ctx)
+	return AWSCredentials(creds), err
+}
@@ -0,0 +1,21 @@
+// Copyright (C) MongoDB, Inc. 2017-present.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License. You may obtain
+// a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+// This package allows credential providers in AWS SDK v2 to be supplied to the
+// MongoDB Go Driver for use with the MONGODB-AWS authentication mechanism.
+//
+// This package is a separate module to avoid adding the AWS SDK as a dependency
+// of the main driver. Users who don't need AWS authentication won't need to
+// import the AWS SDK.
+//
+// NewCredentialsProvider() adapts an AWS CredentialsProvider to be used in:
+//
+//	ClientOptions
+//	ClientEncryptionOptions
+//	AutoEncryptionOptions
+//
+//	ClientOptions
+package awsauth
@@ -0,0 +1,35 @@
+// Copyright (C) MongoDB, Inc. 2017-present.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License. You may obtain
+// a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+package awsauth_test
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"go.mongodb.org/mongo-driver/ext/awsauth"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func Example_defaultConfig() {
+	cfg, err := config.LoadDefaultConfig(context.TODO())
+	if err != nil {
+		panic(err)
+	}
+	awsCredentialProvider := awsauth.NewCredentialsProvider(cfg.Credentials)
+	credential := options.Credential{
+		AuthMechanism:          "MONGODB-AWS",
+		AWSCredentialsProvider: awsCredentialProvider,
+	}
+	client, err := mongo.Connect(
+		options.Client().SetAuth(credential),
+	)
+	if err != nil {
+		panic(err)
+	}
+	_ = client
+}
@@ -0,0 +1,38 @@
+module go.mongodb.org/mongo-driver/ext/awsauth/examples
+
+go 1.25.0
+
+replace (
+	go.mongodb.org/mongo-driver/ext/awsauth => ..
+	go.mongodb.org/mongo-driver/v2 => ../../..
+)
+
+require (
+	github.com/aws/aws-sdk-go-v2/config v1.32.30
+	go.mongodb.org/mongo-driver/ext/awsauth v0.0.0
+	go.mongodb.org/mongo-driver/v2 v2.0.0-beta2
+)
+
+require (
+	github.com/aws/aws-sdk-go-v2 v1.42.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.29 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.4.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.32.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.44.1 // indirect
+	github.com/aws/smithy-go v1.27.3 // indirect
+	github.com/klauspost/compress v1.17.6 // indirect
+	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+	github.com/xdg-go/scram v1.2.0 // indirect
+	github.com/xdg-go/stringprep v1.0.4 // indirect
+	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
+	golang.org/x/crypto v0.33.0 // indirect
+	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
+)
@@ -0,0 +1,72 @@
+github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek=
+github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
+github.com/aws/aws-sdk-go-v2/config v1.32.30 h1:XwsEzpTJfQYJbFicz/QMLwAZdyeNVVoOEkbF7R3gPJk=
+github.com/aws/aws-sdk-go-v2/config v1.32.30/go.mod h1:Ud32SuMc+/9BGxfpSVld7HrE2o05JwKmXY4M3jOQNZU=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.29 h1:WHZGssHH887cO0ox07SIQZsFx3MKD4ps6w0xUEmnKYQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.29/go.mod h1:Mhl0xR6zjguiuj00XRx2wMx22sAltk7oya39sT7fdg8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 h1:/hi1JADLEW9YYryEz1w4GQu0EtP23pP553Cf9KgsDV4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30/go.mod h1:/3AOgy4K17Dm4ucMZVC/MJkzy5kmfKUcINRHZyo0koQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 h1:3GUprIsfmGcC5SACIyB0e7E0BM1O1b3Erl5CePYIAeQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31/go.mod h1:7PuV1yl5e2xnUbm+RqvVg5i2iBM8EyijZNoI9wsOoOc=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 h1:/Z5jmNrKsSD7EmDjzAPsm/3L9IuOkzaynklJZ1qX7S4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30/go.mod h1:lEzEZnOosE7zi8Z6royW1cFJTD9fpab4Ul1SBrllewk=
+github.com/aws/aws-sdk-go-v2/service/signin v1.4.1 h1:V7ZZ300WPXGjvkyore5DGe0ljVPOxCXie/thWdtSBXE=
+github.com/aws/aws-sdk-go-v2/service/signin v1.4.1/go.mod h1:mxC0nT/C8wMMS97DemZPzvUZxvIt+2Iq+eS3JdFZGgg=
+github.com/aws/aws-sdk-go-v2/service/sso v1.32.1 h1:gYFYh4iLLcAOJRLNPY2aD2g9DIhKn4eof8UkIrr1rTk=
+github.com/aws/aws-sdk-go-v2/service/sso v1.32.1/go.mod h1:u8af9Nqkmqnr96f7v9nHqzZT9XBwbXEkTiqT4ROuJSE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1 h1:arjT9Cm3/WYbGmD5TUZHk4UQn4Lle1fUNZs5FC6CtF0=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1/go.mod h1:DMPWJBjYs6+3+f/qhBFEFPPlQ6NlhWjai3dJNvipJ84=
+github.com/aws/aws-sdk-go-v2/service/sts v1.44.1 h1:RvfHDg+xvAeZ+5741vUEjpOVtYSIm93W2zhx10Xtydw=
+github.com/aws/aws-sdk-go-v2/service/sts v1.44.1/go.mod h1:9gdl4RrflIdpDb2TlXshWgR1F9TeCkvqDx77Vpr4Z/Q=
+github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY=
+github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/klauspost/compress v1.17.6 h1:60eq2E/jlfwQXtvZEeBUYADs+BwKBWURIY+Gj2eRGjI=
+github.com/klauspost/compress v1.17.6/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.2.0 h1:bYKF2AEwG5rqd1BumT4gAnvwU/M9nBp2pTSxeZw7Wvs=
+github.com/xdg-go/scram v1.2.0/go.mod h1:3dlrS0iBaWKYVt2ZfA4cj48umJZ+cAEbR6/SjLA88I8=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
+golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -0,0 +1,7 @@
+module go.mongodb.org/mongo-driver/ext/awsauth
+
+go 1.20
+
+require github.com/aws/aws-sdk-go-v2 v1.28.0
+
+require github.com/aws/smithy-go v1.20.2 // indirect
@@ -0,0 +1,4 @@
+github.com/aws/aws-sdk-go-v2 v1.28.0 h1:ne6ftNhY0lUvlazMUQF15FF6NH80wKmPRFG7g2q6TCw=
+github.com/aws/aws-sdk-go-v2 v1.28.0/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
+github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
+github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
@@ -0,0 +1,87 @@
+// Copyright (C) MongoDB, Inc. 2025-present.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License. You may obtain
+// a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+package awsauthtest
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"go.mongodb.org/mongo-driver/ext/awsauth"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+// trackingCredentialsProvider wraps an options.AWSCredentialsProvider and counts calls.
+type trackingCredentialsProvider struct {
+	inner  options.AWSCredentialsProvider
+	called int
+}
+
+func (p *trackingCredentialsProvider) Retrieve(ctx context.Context) (awsauth.AWSCredentials, error) {
+	p.called++
+	return p.inner.Retrieve(ctx)
+}
+
+// TestAWSDefaultCustomCredentialProviderAuthenticates is prose test 1:
+// "Custom Credential Provider Authenticates" from the MongoDB AWS auth spec.
+// https://github.com/mongodb/specifications/blob/master/source/auth/tests/mongodb-aws.md
+//
+// Uses the AWS SDK default credential chain so all 6 scenarios (Regular, EC2, ECS,
+// AssumeRole, WebIdentity, Lambda) are covered in environments where the SDK can
+// resolve credentials automatically without needing inline credentials in the URI.
+func TestAWSDefaultCustomCredentialProviderAuthenticates(t *testing.T) {
+	if test := os.Getenv("AWS_TEST"); test == "assume-role" || test == "regular" {
+		t.Skipf("Skipping test for %s", test)
+	}
+
+	rawURI := os.Getenv("MONGODB_URI")
+	if rawURI == "" {
+		t.Skip("MONGODB_URI not set")
+	}
+
+	cfg, err := config.LoadDefaultConfig(context.Background())
+	if err != nil {
+		t.Fatalf("failed to load AWS config: %v", err)
+	}
+
+	tracking := &trackingCredentialsProvider{
+		inner: awsauth.NewCredentialsProvider(cfg.Credentials),
+	}
+
+	// SetAuth overrides any inline credentials that ApplyURI may have extracted
+	// from the URI; the AWS SDK default chain provides credentials instead.
+	client, err := mongo.Connect(
+		options.Client().
+			ApplyURI(rawURI).
+			SetAuth(options.Credential{
+				AuthMechanism:          "MONGODB-AWS",
+				AWSCredentialsProvider: tracking,
+			}),
+	)
+	if err != nil {
+		t.Fatalf("failed to connect: %v", err)
+	}
+	defer func() {
+		if err := client.Disconnect(context.Background()); err != nil {
+			t.Errorf("Disconnect: %v", err)
+		}
+	}()
+
+	err = client.Database("aws").Collection("test").
+		FindOne(context.Background(), bson.D{{Key: "x", Value: 1}}).Err()
+	if err != nil && !errors.Is(err, mongo.ErrNoDocuments) {
+		t.Fatalf("unexpected FindOne error: %v", err)
+	}
+
+	if tracking.called == 0 {
+		t.Fatal("expected custom credential provider to be called at least once")
+	}
+}