GODRIVER-3567 Add optional AWS SDK v2-based MONGODB-AWS authenticator submodule by qingyang-hu · Pull Request #2508 · mongodb/mongo-go-driver

qingyang-hu · 2026-07-23T21:27:12Z

Summary

This PR allows users to plug a custom AWS SDK v2 credentials provider into the driver's MONGODB-AWS authentication mechanism without forcing the AWS SDK as a dependency on the core driver.

Additionally, EKS Pod Identity and other AWS SDK-native authentication are made possible by the ext/awsauth submodule as required in GODRIVER-3571.

The custom provider overrides environment variables and all automatic sources, superseded only by explicit URI credentials as required in GODRIVER-3615.

Background & Motivation

This PR contains two stacked commits.

881bc5f:

New public interface in mongo/options (clientoptions.go)
- Adds AWSCredentialsProvider interface (Retrieve(ctx) (AWSCredentials, error)) and an AWSCredentials struct alias.
- Wires a new AWSCredentialsProvider field into Credential, and into ClientEncryptionOptions / AutoEncryptionOptions.
New ext/awsauth sub module
- NewCredentialsProvider(aws.CredentialsProvider) adapts an AWS SDK v2 provider to the driver's options.AWSCredentialsProvider interface. The adapter relies on AWSCredentials being a struct type alias so aws.Credentials converts directly.
Internal adapter (internal/credutil/aws_options_provider.go
- AWSOptionsProvider bridges the public options.AWSCredentialsProvider to the driver's internal credentials.Provider type.

bbedca6:

Tests and Plumbing:
- Prose test for GODRIVER-3615
- Examples for GODRIVER-3999
- compilecheck GODRIVER-3998

Notes

Instead of the v1.0.0 specified in the original design, the ext/awsauth submodule depends on aws-sdk-go-v2 v1.28.0 in this PR. v1.28.0 is the earliest version that is compatible with the current Credentials struct.

evergreen-ci-prod · 2026-07-23T21:27:15Z

There is an existing patch(es) for this commit SHA:

Evergreen patch with PR

Please note that the status that is posted is not in the context of this PR but rather the (latest) existing patch and that may affect some tests that may depend on the particular PR. If your tests do not rely on any PR-specific values (like base or head branch name) then your tests will report the same status. If you would like a patch to run in the context of this PR and abort the other(s), comment 'evergreen retry'.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

qingyang-hu · 2026-07-23T21:41:31Z

Reordered to align with aws.Credentials

prestonvasquez · 2026-07-23T21:45:52Z

[nit] We should use github.com/stretchr/testify/require to match the rest of the driver test suite.

prestonvasquez · 2026-07-23T22:05:29Z

[question] Why not use the latest version? 1.20 is EOL.

The rationale is to use a minimum requirement while supporting the earliest aws-sdk-go-v2 version that is compatible with the current aws.Credentials. Therefore, aws-sdk-go-v2 v1.28.0 is used and it requires golang 1.20.

@qingyang-hu Why do we need to do that?

Under Minimal Version Selection, requiring aws-sdk-go-v2 v1.28.0 only means "at least v1.28.0." Any user who already depends on a newer SDK will have MVS select that higher version automatically. Pinning the minimum compatible version imposes the least constraint on downstream users.

go 1.20 is a minimum language level, not a build toolchain. The directive is inherited from aws-sdk-go-v2 v1.28.0's own go 1.20 and just declares the minimum language features the module uses. Users still build with their own (newer) toolchain. Declaring go 1.20 simply maximizes how broadly this submodule can be imported. It doesn't apply the way it would to actually compiling with an EOL compiler.

This is also consistent with the intent of splitting ext/awsauth into its own module (not forcing the AWS SDK onto core driver users) and with the driver's generally conservative Go-version policy.

The AWS version isn't tied to which version of Go we use. We should use a Go version that is currently being supported so that we don't have issues with dependabot trying to bump dependencies due to CVEs, etc. This is an experimental API, I would wait to see if we have a consumer complain about it first. Besides, the code is very copyable.

prestonvasquez · 2026-07-23T22:13:12Z

[question] This test intentionally skips assume-role and regular. We should update this comment to reflect that and also why we skip these cases.

@qingyang-hu This is an open question.

mongodb-drivers-pr-bot · 2026-07-24T16:27:47Z

🧪 Performance Results

Commit SHA: e3d48e7

The following benchmark tests for version 6a63cfdcd669c7000763c54d had statistically significant changes (i.e., |z-score| > 1.96):

Benchmark	Measurement	% Change	Patch Value	Stable Region	H-Score	Z-Score
BenchmarkSingleRunCommand	total_time_seconds	5.9878	1.1972	Avg: 1.1296 Med: 1.1301 Stdev: 0.0344	0.7260	1.9684
BenchmarkBSONFlatDocumentDecoding	ops_per_second_max	3.1493	22031.2844	Avg: 21358.6330 Med: 21360.6750 Stdev: 326.4317	0.7278	2.0606
BenchmarkBSONDeepDocumentDecoding	total_time_seconds	-1.2168	1.1843	Avg: 1.1989 Med: 1.1989 Stdev: 0.0059	0.7936	-2.4848

For a comprehensive view of all microbenchmark results for this PR's commit, please check out the Evergreen perf task for this patch.

mongodb-drivers-pr-bot · 2026-07-24T16:30:24Z

API Change Report

./v2/mongo/options

compatible changes

(*AutoEncryptionOptions).SetAWSCredentialsProvider: added
(*ClientEncryptionOptionsBuilder).SetAWSCredentialsProvider: added
AWSCredentials: added
AWSCredentialsProvider: added
AutoEncryptionOptions.AWSCredentialsProvider: added
ClientEncryptionOptions.AWSCredentialsProvider: added
Credential.AWSCredentialsProvider: added

./v2/x/mongo/driver/mongocrypt/options

compatible changes

MongoCryptOptions.AWSCredentialsProvider: added

prestonvasquez · 2026-07-24T21:23:35Z

@qingyang-hu This is an open question.

prestonvasquez · 2026-07-24T21:56:02Z

+	provider := aws.CredentialsProviderFunc(func(context.Context) (aws.Credentials, error) {
+		return aws.Credentials{}, nil


[blocking] It's unclear to me why we would need to go through the entire compile check with this separate option. We should revert these changes and simply rely on ext/awsauth/test and ext/awsauth/examples.

prestonvasquez · 2026-07-24T22:04:04Z

+// not use this file except in compliance with the License. You may obtain
+// a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+package awsauthtest


[blocking] We should add a test/compilecheck/ package here and tie it into the compile-check evergreen task:

var _ options.AWSCredentialsProvider = (*awsauth.CredentialsProvider)(nil)

qingyang-hu added 3 commits July 22, 2026 19:49

add ext/awsauth submodule

881bc5f

add tests and examples

bbedca6

address copilot review

61ace3a

github-actions Bot added the review-priority-normal Medium Priority PR for Review: within 1 business day label Jul 23, 2026

qingyang-hu marked this pull request as ready for review July 23, 2026 21:30

qingyang-hu requested a review from a team as a code owner July 23, 2026 21:30

qingyang-hu requested review from Copilot and matthewdale July 23, 2026 21:30

Copilot AI reviewed Jul 23, 2026

qingyang-hu requested a review from prestonvasquez July 23, 2026 21:31

qingyang-hu commented Jul 23, 2026

View reviewed changes

Comment thread internal/aws/credentials/credentials.go

qingyang-hu Jul 23, 2026

Copy link
Copy Markdown

Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reordered to align with aws.Credentials

qingyang-hu added the feature label Jul 23, 2026

prestonvasquez requested changes Jul 23, 2026

View reviewed changes

qingyang-hu added 2 commits July 24, 2026 12:19

update comments

4417f66

update awsauth test

2d4cdf6

Merge branch 'master' into godriver3567awsauth

e3d48e7

qingyang-hu requested a review from prestonvasquez July 24, 2026 20:49

prestonvasquez requested changes Jul 24, 2026

View reviewed changes

		provider := aws.CredentialsProviderFunc(func(context.Context) (aws.Credentials, error) {
		return aws.Credentials{}, nil

Uh oh!

Conversation

qingyang-hu commented Jul 23, 2026

Summary

Background & Motivation

Notes

Uh oh!

evergreen-ci-prod Bot commented Jul 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mongodb-drivers-pr-bot Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 Performance Results

Uh oh!

mongodb-drivers-pr-bot Bot commented Jul 24, 2026

API Change Report

./v2/mongo/options

compatible changes

./v2/x/mongo/driver/mongocrypt/options

compatible changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mongodb-drivers-pr-bot Bot commented Jul 24, 2026 •

edited

Loading