CSHARP-5696: Integrate AWS SDK v4 in MongoDB.Driver.Authentication.AWS by papafe · Pull Request #2064 · mongodb/mongo-csharp-driver

papafe · 2026-07-07T10:20:19Z

https://jira.mongodb.org/browse/CSHARP-5696

Migrates MongoDB.Driver.Authentication.AWS to AWS SDK for .NET v4 (AWSSDK.SecurityToken 4.0.100.2), replacing the deprecated FallbackCredentialsFactory with DefaultAWSCredentialsIdentityResolver. Targeted for the next major release.

Supersedes #2054 (from @BossDarkReaper).

Copilot

Pull request overview

Updates the MongoDB AWS authentication helper package to use AWS SDK for .NET v4 credential resolution, replacing deprecated v3 APIs and aligning the driver with the new SDK credential provider entry points.

Changes:

Bumped AWSSDK.SecurityToken dependency from v3 to v4.
Switched fallback credential resolution from FallbackCredentialsFactory to DefaultAWSCredentialsIdentityResolver, adding caching for the resolved provider.
Removed an AWS SDK handler-coverage test that depended on v3 internals.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
tests/MongoDB.Driver.Tests/Communication/Security/AwsAuthenticationTests.cs	Removes a v3-specific credential provider chain test.
src/MongoDB.Driver.Authentication.AWS/MongoDB.Driver.Authentication.AWS.csproj	Updates the AWS SDK SecurityToken package reference to v4.
src/MongoDB.Driver.Authentication.AWS/CredentialsSources/AWSFallbackCredentialsSource.cs	Replaces v3 fallback factory with v4 identity resolver and adds provider caching.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

            _lock.Wait(cancellationToken);
            try
            {
-                // returns cached credentials source immediately. Only if cached source unavailable, makes quite heavy steps
-                credentialsSource = FallbackCredentialsFactory.GetCredentials();
+                // resolving the credentials source walks the full provider chain, so cache it and reuse until reset
+                credentialsSource = _cachedCredentialsSource ??= DefaultAWSCredentialsIdentityResolver.GetCredentials(null);


            await _lock.WaitAsync(cancellationToken).ConfigureAwait(false);
            try
            {
-                // returns cached credentials source immediately. Only if cached source unavailable, makes quite heavy steps
-                credentialsSource = FallbackCredentialsFactory.GetCredentials();
+                // resolving the credentials source walks the full provider chain, so cache it and reuse until reset
+                credentialsSource = _cachedCredentialsSource ??= await DefaultAWSCredentialsIdentityResolver.GetCredentialsAsync(null).ConfigureAwait(false);


papafe · 2026-07-07T15:54:53Z

        [Fact]
        public void Ecs_should_fill_AWS_CONTAINER_CREDENTIALS_RELATIVE_URI()
        {
            var isEcs = Environment.GetEnvironmentVariable("AWS_ECS_ENABLED") != null;
            var awsContainerUri = Environment.GetEnvironmentVariable("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") ?? Environment.GetEnvironmentVariable("AWS_CONTAINER_CREDENTIALS_FULL_URI");


So... I'm not sure we need this test. For a couple of reasons:

We don't have those methods used here anymore. FallbackCredentialsFactory.CredentialsGenerators is obsolete and its closest candidate AWSConfigs.AWSCredentialsGenerators is write only, so we can't read the default handlers

This test was essentially verifying that we get the "expected" chain of handlers to retrieve AWS credentials. Should we worry that the official SDK actually uses our "expected" chain of handlers?

We actually verify that the correct credentials are chosen in our CI matrix with our run-aws-auth-test-with-... tasks.

papafe · 2026-07-08T14:42:44Z

            var awsContainerUri = Environment.GetEnvironmentVariable("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") ?? Environment.GetEnvironmentVariable("AWS_CONTAINER_CREDENTIALS_FULL_URI");
            (awsContainerUri != null).Should().Be(isEcs);
        }
-


I added the following as an answer to a Copilot comment, but I think it's worth to add it here as well.

So... I'm not sure we need this test. For a couple of reasons:

We don't have those methods used here anymore. FallbackCredentialsFactory.CredentialsGenerators is obsolete and its closest candidate AWSConfigs.AWSCredentialsGenerators is write only, so we can't read the default handlers.

This test was essentially verifying that we get the "expected" chain of handlers to retrieve AWS credentials. Should we worry that the official SDK actually uses our "expected" chain of handlers?

We actually verify that the correct credentials are chosen in our CI matrix with our run-aws-auth-test-with-... tasks.

It seemed we were testing third-party library internals so I am supporting dropping the test. Unless there is a very good reason for doing so. @sanych-sun thoughts?

@sanych-sun Do you agree with removing this test?

I'm OK with dropping the test as long as there is no our code involved.

codeowners-service-app · 2026-07-09T11:12:35Z

Assigned sanych-sun for team dbx-csharp-dotnet because adelinowona is out of office.

Co-authored-by: BossDarkReaper <8506424+BossDarkReaper@users.noreply.github.com>

adelinowona

You should also update the AGENTS.md files in the project for any reference to AWS SDK v3 stuff

adelinowona · 2026-07-22T21:07:42Z

            var awsContainerUri = Environment.GetEnvironmentVariable("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") ?? Environment.GetEnvironmentVariable("AWS_CONTAINER_CREDENTIALS_FULL_URI");
            (awsContainerUri != null).Should().Be(isEcs);
        }
-


It seemed we were testing third-party library internals so I am supporting dropping the test. Unless there is a very good reason for doing so. @sanych-sun thoughts?

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

src/MongoDB.Driver.Authentication.AWS/CredentialsSources/AWSFallbackCredentialsSource.cs:51

ResetCache() is now a no-op, but it’s still called from AWSSaslMechanism.TryHandleAuthenticationException to drop cached AWS credentials after an auth failure. With this implementation, the driver can no longer force a re-resolution/refresh on the next attempt.

Either wire ResetCache() to the AWS SDK v4 cache-invalidation mechanism (if available), or change the driver-side contract/callers so the method name and behavior stay consistent.

        public void ResetCache()
        {
            // No-op: DefaultAWSCredentialsIdentityResolver owns credential caching and invalidates on
            // environment/config changes.
        }

src/MongoDB.Driver.Authentication.AWS/CredentialsSources/AWSFallbackCredentialsSource.cs:43

GetCredentialsAsync accepts a CancellationToken but the token is only checked once and isn’t propagated into the AWS SDK calls. If credential resolution or IMDS/ECS calls block, callers can’t cancel the in-flight operation.

If the AWS SDK v4 APIs expose overloads that accept a CancellationToken, prefer using those; otherwise consider documenting this limitation (or reworking the implementation so cancellation can interrupt the underlying work).

This issue also appears on line 47 of the same file.

        public async Task<AWSCredentials> GetCredentialsAsync(CancellationToken cancellationToken)
        {
            cancellationToken.ThrowIfCancellationRequested();
            var credentialsSource = await DefaultAWSCredentialsIdentityResolver.GetCredentialsAsync(null).ConfigureAwait(false);
            var immutableCredentials = await credentialsSource.GetCredentialsAsync().ConfigureAwait(false);

adelinowona · 2026-07-28T22:41:40Z

-            }
-
+            cancellationToken.ThrowIfCancellationRequested();
+            var credentialsSource = await DefaultAWSCredentialsIdentityResolver.GetCredentialsAsync(null).ConfigureAwait(false);


Also this probably doesn't have to block this PR any further (can be investigated in a separate ticket) but copilot had a comment about how our cancellationToken isn't passed to the AWS SDK. Upon inspecting the SDK code, it will use its own default cancellationToken of 35 seconds if we use the DefaultAWSCredentialsIdentityResolver.GetCredentials/GetCredentialsAsync methods. There is also ResolveIdentity(IClientConfig, CancellationToken) / ResolveIdentityAsync(...) methods which are instance methods that do take a cancellationToken so if we really wanted to fix this and honor our cancellationToken, we could create our own DefaultAWSCredentialsIdentityResolver instance and call ResolveIdentity(IClientConfig, CancellationToken) / ResolveIdentityAsync(...) so we can pass our cancellationToken.

Also worth investigating if IAWSCredentialsSource needs to be disposable since its dispose currently does nothing.

I agree with this, I'll create a follow up ticket.

Created: https://jira.mongodb.org/browse/CSHARP-6145

…entialsSource

Copilot AI review requested due to automatic review settings July 7, 2026 10:20

papafe requested a review from a team as a code owner July 7, 2026 10:20

papafe requested a review from ajcvickers July 7, 2026 10:20

Copilot started reviewing on behalf of papafe July 7, 2026 10:20 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

papafe added the maintenance Non-code maintenance (deps, docs, configs, etc.). label Jul 7, 2026

papafe marked this pull request as draft July 7, 2026 10:25

papafe removed the request for review from ajcvickers July 7, 2026 10:25

papafe commented Jul 7, 2026

View reviewed changes

Comment thread src/MongoDB.Driver.Authentication.AWS/CredentialsSources/AWSFallbackCredentialsSource.cs Outdated

papafe requested a review from adelinowona July 8, 2026 14:41

papafe marked this pull request as ready for review July 8, 2026 14:41

papafe commented Jul 8, 2026

View reviewed changes

codeowners-service-app Bot requested a review from sanych-sun July 9, 2026 11:12

CSHARP-5696: Integrate AWS SDK v4 in MongoDB.Driver.Authentication.AWS

3c7211a

Co-authored-by: BossDarkReaper <8506424+BossDarkReaper@users.noreply.github.com>

papafe force-pushed the csharp5696 branch from ca7fec9 to 3c7211a Compare July 20, 2026 14:38

adelinowona requested changes Jul 22, 2026

View reviewed changes

papafe added 2 commits July 28, 2026 14:03

CSHARP-5696: Delegate AWS credential caching to the SDK resolver

7fa6e8b

CSHARP-5696: Trim ResetCache comment

6623348

papafe requested review from adelinowona and Copilot July 28, 2026 12:09

Copilot started reviewing on behalf of papafe July 28, 2026 12:40 View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

adelinowona requested changes Jul 28, 2026

View reviewed changes

CSHARP-5696: Remove now-dead ResetCache and IDisposable from IAWSCred…

e709b97

…entialsSource

papafe requested a review from adelinowona July 29, 2026 08:51

adelinowona approved these changes Jul 29, 2026

View reviewed changes

papafe merged commit c2b9a31 into mongodb:main Jul 30, 2026
21 of 28 checks passed

papafe deleted the csharp5696 branch August 13, 2026 08:34

Uh oh!

Conversation

papafe commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

papafe Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

papafe Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adelinowona Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

papafe Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

sanych-sun Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

codeowners-service-app Bot commented Jul 9, 2026

Uh oh!

adelinowona left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

adelinowona Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

adelinowona Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

papafe Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

papafe Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

papafe commented Jul 7, 2026 •

edited

Loading

papafe Jul 8, 2026 •

edited

Loading

adelinowona Jul 28, 2026 •

edited

Loading