> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # AWS IAM Authentication **Note:** The MongoDB Atlas Shared Responsibility Model defines the complementary duties of MongoDB and its customers in maintaining a secure and resilient data environment. Under this framework, MongoDB manages the security and operational integrity of the underlying platform, while customers are responsible for the configuration, management, and data policies of their specific deployments. For a detailed breakdown of ownership across security and operational excellence, see [Shared Responsibility Model.](https://www.mongodb.com/resources/products/fundamentals/shared-responsibility) ## Overview You can use AWS (Amazon Web Services) IAM (Identity and Access Management) Users or Roles to authenticate database users to your Atlas clusters without managing passwords. Using AWS (Amazon Web Services) IAM (Identity and Access Management) reduces the number of authentication mechanisms and number of secrets to manage. Atlas does not receive your authentication secret key over the wire and the driver does not persist it. Choose the appropriate authentication method for your use case: - **IAM Roles**: Roles that AWS services (EC2, Lambda, ECS) or federated users assume. We recommend that you use IAM Roles for application and workload access for workloads running on AWS compute resources. - **IAM Users**: Individual AWS users that need direct database access. This option might suit applications running with specific user credentials. For human users such as developers and administrators, we recommend that you use [Workforce Identity Federation with OIDC](https://www.mongodb.com/docs/atlas/workforce-oidc/#std-label-oidc-authentication-workforce) for a direct SSO experience with your identity provider. **Important:** Before clients can connect using AWS IAM database authentication, you must create database users that are configured for IAM authentication. To learn how to create database users that use `IAM Users` or `IAM Roles` for authentication, see [Manage Database Users.](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-add-mongodb-users) **Note:** Atlas uses AWS (Amazon Web Services) STS (Security Token Service) to verify the identity of IAM (Identity and Access Management) users and roles. AWS (Amazon Web Services) enforces a [default request quota](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) of 600 requests per second, per account, per region. This quota is applied against the AWS (Amazon Web Services) account of the IAM (Identity and Access Management) user or role. ## Set Up Authentication with AWS IAM Roles You can set up AWS (Amazon Web Services) IAM (Identity and Access Management) Roles to authenticate AWS (Amazon Web Services) compute types to your Atlas clusters. **Note:** You can't set up authentication for AWS (Amazon Web Services) IAM principals when LDAP (Lightweight Directory Access Protocol) authorization is enabled. If you require authentication for an AWS IAM principal, consider moving the clusters that you want to access with AWS (Amazon Web Services) IAM authentication into another project where LDAP (Lightweight Directory Access Protocol) authorization is disabled. For AWS (Amazon Web Services) Lambda and HTTP (ECS and EC2), drivers automatically read from the [environment variables](https://github.com/mongodb/specifications/blob/master/source/auth/auth.rst#obtaining-credentials). For AWS (Amazon Web Services) EKS, you must manually assign the IAM (Identity and Access Management) role. This page describes how AWS (Amazon Web Services) Lambda, AWS (Amazon Web Services) ECS (Elastic Container Service), and AWS (Amazon Web Services) EKS (Elastic Kubernetes Service) can connect using an AWS (Amazon Web Services) IAM (Identity and Access Management) role. **Note:** You must assign an IAM (Identity and Access Management) role to Lambda, EC2, ECS, or EKS in the AWS (Amazon Web Services) console. ### AWS Lambda AWS (Amazon Web Services) Lambda passes information to functions through the following environment variables if you [assign an execution role](http://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html) to the lambda function. - `AWS_ACCESS_KEY_ID` - `AWS_SECRET_ACCESS_KEY` - `AWS_SESSION_TOKEN` **Note:** You don't need to manually create these environment variables when you use an [execution role](http://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html) in your function. To learn more about these environment variables, see [Using AWS Lambda environment variables.](http://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html) ## Grant Database Access to AWS IAM Roles To grant database access to the AWS (Amazon Web Services) IAM (Identity and Access Management) role, complete the steps described in the [Configure Database Users](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-mongodb-users) section for AWS (Amazon Web Services) IAM (Identity and Access Management). For more information on granting database access using Atlas CLI, Atlas Administration API, or Atlas UI, see [Configure Database Users.](https://www.mongodb.com/docs/atlas/security-add-mongodb-users.md#std-label-add-mongodb-users) ## Connect to Atlas Cluster Using AWS IAM To connect to Atlas with your AWS (Amazon Web Services) IAM (Identity and Access Management) credentials using [`mongosh`](https://www.mongodb.com/docs/mongodb-shell.md#mongodb-binary-bin.mongosh), provide [a connection string that specifies the MONGODB-AWS authentication mechanism](https://www.mongodb.com/docs/manual/reference/connection-string.md#std-label-find-connection-string). This connection string format applies to all AWS IAM authentication mechanisms. **Important:** You must configure authentication using one of the methods described in [Set Up Authentication with AWS IAM Roles](https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md#std-label-passwordless-auth-aws-no-saml) before you can use this connection string format. Connecting to Atlas using AWS IAM authentication with the [`mongosh`](https://www.mongodb.com/docs/mongodb-shell.md#mongodb-binary-bin.mongosh) requires shell version v0.9.0 or higher. Consider the following: - Use your [AWS IAM credentials](https://console.aws.amazon.com/iam/home?region=us-west-2#/security_credentials), using your access key ID as your username and your secret key as your password. - The `authSource` query parameter is `$external`, URL-encoded as `%24external`. - The `authMechanism` query parameter is `MONGODB-AWS`. **Example:** ```sh mongosh "mongodb+srv:///test?authSource=%24external&authMechanism=MONGODB-AWS" --username --password ``` **See also:** [IAM roles for service accounts](http://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html)