@@ -344,7 +344,13 @@ functions:
344
344
345
345
"iam_auth_ec2_instance_account" : "${iam_auth_ec2_instance_account}",
346
346
"iam_auth_ec2_instance_secret_access_key" : "${iam_auth_ec2_instance_secret_access_key}",
347
- "iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}"
347
+ "iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}",
348
+
349
+ "iam_auth_assume_web_role_name": "${iam_auth_assume_web_role_name}",
350
+ "iam_web_identity_issuer": "${iam_web_identity_issuer}",
351
+ "iam_web_identity_rsa_key": "${iam_web_identity_rsa_key}",
352
+ "iam_web_identity_jwks_uri": "${iam_web_identity_jwks_uri}",
353
+ "iam_web_identity_token_file": "${iam_web_identity_token_file}"
348
354
}
349
355
EOF
350
356
@@ -429,6 +435,67 @@ functions:
429
435
echo "" > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
430
436
JAVA_VERSION=${JAVA_VERSION} AWS_CREDENTIAL_PROVIDER=${AWS_CREDENTIAL_PROVIDER} .evergreen/run-mongodb-aws-test.sh
431
437
438
+ " run aws auth test with web identity credentials " :
439
+ - command : shell.exec
440
+ type : test
441
+ params :
442
+ working_dir : " src"
443
+ shell : " bash"
444
+ script : |
445
+ ${PREPARE_SHELL}
446
+ cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
447
+ . ./activate-authawsvenv.sh
448
+ mongo aws_e2e_web_identity.js
449
+ - command : shell.exec
450
+ type : test
451
+ params :
452
+ working_dir : " src"
453
+ shell : " bash"
454
+ silent : true
455
+ script : |
456
+ # DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
457
+ cat <<'EOF' > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
458
+ export AWS_ROLE_ARN="${iam_auth_assume_web_role_name}"
459
+ export AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}"
460
+ EOF
461
+ - command : shell.exec
462
+ type : test
463
+ params :
464
+ working_dir : " src"
465
+ shell : " bash"
466
+ script : |
467
+ ${PREPARE_SHELL}
468
+ if [ "${AWS_CREDENTIAL_PROVIDER}" = "builtIn" ]; then
469
+ echo "Built-in AWS credential provider does not support the web identity auth test, skipping..."
470
+ exit 0
471
+ fi
472
+ JAVA_VERSION=${JAVA_VERSION} AWS_CREDENTIAL_PROVIDER=${AWS_CREDENTIAL_PROVIDER} ASSERT_NO_URI_CREDS=true .evergreen/run-mongodb-aws-test.sh
473
+ - command : shell.exec
474
+ type : test
475
+ params :
476
+ working_dir : " src"
477
+ shell : " bash"
478
+ silent : true
479
+ script : |
480
+ # DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
481
+ cat <<'EOF' > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
482
+ export AWS_ROLE_ARN="${iam_auth_assume_web_role_name}"
483
+ export AWS_WEB_IDENTITY_TOKEN_FILE="${iam_web_identity_token_file}"
484
+ export AWS_ROLE_SESSION_NAME="test"
485
+ EOF
486
+ - command : shell.exec
487
+ type : test
488
+ params :
489
+ working_dir : " src"
490
+ shell : " bash"
491
+ script : |
492
+ ${PREPARE_SHELL}
493
+ if [ "${AWS_CREDENTIAL_PROVIDER}" = "builtIn" ]; then
494
+ echo "Built-in AWS credential provider does not support the web identity auth test, skipping..."
495
+ exit 0
496
+ fi
497
+ JAVA_VERSION=${JAVA_VERSION} AWS_CREDENTIAL_PROVIDER=${AWS_CREDENTIAL_PROVIDER} ASSERT_NO_URI_CREDS=true .evergreen/run-mongodb-aws-test.sh
498
+
432
499
" run aws auth test with aws credentials as environment variables " :
433
500
- command : shell.exec
434
501
type : test
@@ -884,6 +951,16 @@ tasks:
884
951
- func : " add aws auth variables to file"
885
952
- func : " run aws auth test with aws EC2 credentials"
886
953
954
+ - name : " aws-auth-test-with-web-identity-credentials"
955
+ commands :
956
+ - func : " bootstrap mongo-orchestration"
957
+ vars :
958
+ AUTH : " auth"
959
+ ORCHESTRATION_FILE : " auth-aws.json"
960
+ TOPOLOGY : " server"
961
+ - func : " add aws auth variables to file"
962
+ - func : " run aws auth test with web identity credentials"
963
+
887
964
- name : " aws-ECS-auth-test"
888
965
commands :
889
966
- func : " bootstrap mongo-orchestration"
@@ -1893,6 +1970,7 @@ buildvariants:
1893
1970
- name : " aws-auth-test-with-aws-credentials-as-environment-variables"
1894
1971
- name : " aws-auth-test-with-aws-credentials-and-session-token-as-environment-variables"
1895
1972
- name : " aws-auth-test-with-aws-EC2-credentials"
1973
+ - name : " aws-auth-test-with-web-identity-credentials"
1896
1974
1897
1975
- matrix_name : " aws-ecs-auth-test"
1898
1976
matrix_spec : { ssl: "nossl", jdk: ["jdk8", "jdk17"], version: ["4.4", "5.0", "6.0", "latest"], os: "ubuntu" }
0 commit comments