AWS IAM Authentication MechanismAWS IAM身份验证机制

To authenticate to your MongoDB instance using AWS credentials stored in environment variables available through process.env, set the following variables by using a shell:要使用存储在processenv环境变量中的AWS凭据对MongoDB实例进行身份验证，请使用shell设置以下变量：

export AWS_ACCESS_KEY_ID=<awsKeyId>
export AWS_SECRET_ACCESS_KEY=<awsSecretKey>
export AWS_SESSION_TOKEN=<awsSessionToken>

AWS recommends using regional AWS STS endpoints instead of global endpoints to reduce latency, build-in redundancy, and increase session token validity. AWS建议使用区域AWS STS端点而不是全局端点，以减少延迟、内置冗余并提高会话令牌有效性。To set the AWS region, set AWS_REGION and AWS_STS_REGIONAL_ENDPOINTS as environment variables, as shown in the following example:要设置AWS区域，请将AWS_REGION和AWS_STS_REGIONAL_ENDPOINTS设置为环境变量，如下例所示：

export AWS_STS_REGIONAL_ENDPOINTS=regional // Enables regional endpoints
export AWS_REGION=us-east-1 // Sets your AWS region

If both these environment variables aren't set, the default region is us-east-1. For a list of available AWS regions, see the Regional Endpoints section of the AWS Service Endpoints reference in the AWS documentation.如果这两个环境变量都没有设置，则默认区域为us-east-1。有关可用AWS区域的列表，请参阅AWS文档中AWS服务端点参考的区域端点部分。

After you've set the preceding environment variables, specify the MONGODB-AWS authentication mechanism in your connection string as shown in the following example:设置完上述环境变量后，在连接字符串中指定MONGODB-AWS身份验证机制，如下例所示：

const { MongoClient } = require("mongodb");

// Remember to specify your AWS credentials in environment variables.请记住在环境变量中指定您的AWS凭据。
const clusterUrl = "<cluster_url>";
const authMechanism = "MONGODB-AWS";

let uri =
  `mongodb+srv://${clusterUrl}/?authSource=%24external&authMechanism=${authMechanism}`;

// Create a new MongoClient.创建一个新的MongoClient。
const client = new MongoClient(uri);

async function run() {
  try {
    // Establish and verify connection.建立并验证连接。
    await client.db("admin").command({ ping: 1 });
    console.log("Connected successfully to server.");
  } finally {
    // Ensure that the client closes when it finishes/errors.确保客户端在完成/出错时关闭。
    await client.close();
  }
}
run().catch(console.dir);

You can use the OpenID Connect (OIDC) token obtained from a web identity provider to authenticate to Amazon Elastic Kubernetes Service (EKS) or other services.您可以使用从web身份提供者获得的OpenID Connect(OIDC)令牌对Amazon Elastic Kubernetes Service(EKS)或其他服务进行身份验证。

To authenticate with your OIDC token you must first install @aws-sdk/credential-providers. You can install this dependency using the following npm command:要使用OIDC令牌进行身份验证，您必须首先安装@aws-sdk/credential-providers提供程序。您可以使用以下npm命令安装此依赖关系：

npm install @aws-sdk/credential-providers

Next, create a file that contains your OIDC token. Then set the absolute path to this file in an environment variable by using a shell as shown in the following example:接下来，创建一个包含OIDC令牌的文件。然后使用shell在环境变量中设置此文件的绝对路径，如下例所示：

export AWS_WEB_IDENTITY_TOKEN_FILE=<absolute path to file containing your OIDC token>

After you've set the preceding environment variable, specify the MONGODB-AWS authentication mechanism in your connection string as shown in the following example:设置完上述环境变量后，在连接字符串中指定MONGODB-AWS身份验证机制，如下例所示：

const { MongoClient } = require("mongodb");

// Remember to specify your AWS credentials in environment variables.请记住在环境变量中指定您的AWS凭据。
const clusterUrl = "<cluster_url>";
const authMechanism = "MONGODB-AWS";

let uri =
  `mongodb+srv://${clusterUrl}/?authSource=%24external&authMechanism=${authMechanism}`;

// Create a new MongoClient.
const client = new MongoClient(uri);

async function run() {
  try {
    // Establish and verify connection.
    await client.db("admin").command({ ping: 1 });
    console.log("Connected successfully to server.");
  } finally {
    // Ensure that the client closes when it finishes/errors.确保客户端在完成/出错时关闭。
    await client.close();
  }
}
run().catch(console.dir);