Support of AWS' DocumentDB ?

[TechnicalMercenary]

AWS has a 'mongo like' product called DocumentDB. It is close enough to mongo that standard mongo drivers can integrate with it.

When a DocumentDb database is created, AWS provides a TLS Certificate to secure communication.

Searching the web and this discussion forum, I have not seen any details regarding documentDB or certificate support in general.

Is using a TLS cert to secure a db connection possible ?

[dstepanov]

Maybe there is something in the Micronaut AWS module documentation https://micronaut-projects.github.io/micronaut-aws/latest/guide/

[graemerocher]

It is planned to potentially support DocumentDB one day as part of Micronaut Data MongoDB, perhaps later this year.

[dstepanov]

Did it work for you? You might need to enable SSL for Mongo driver

[o-shevchenko]

Did it work for you?

Haven't tried yet.

You might need to enable SSL for Mongo driver

I don't see any tls or certificate mentioned in Mongo Client code. What configuration do you mean?

[dstepanov]

If you look inside DefaultMongoConfiguration you can see there is a builder for SSL configuration, so it should be possible to write:

mongodb:
   uri: xxx
   ssl: true

[o-shevchenko]

then yes, I set it.
But the problem is that there isn't an option to set the certificate path for MongoDB.
Something like in pymongo: https://pymongo.readthedocs.io/en/stable/examples/tls.html

client = pymongo.MongoClient('example.com',
                             tls=True,
                             tlsCertificateKeyFile='/path/to/client.pem')

[o-shevchenko]

I successfully connected to DocumentDB using the following configurations:

mongodb:
  uri: mongodb://<USER>:<PASSWORD>@<HOST>:<PORT>/<DBNAME>?ssl=true&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false

SSL cert should be added to Java truststore (https://docs.aws.amazon.com/documentdb/latest/developerguide/connect_programmatically.html).
I added two certificates:

keytool -importcert -noprompt -file /tmp/rds-ca-2019-root.pem -keystore /usr/local/java/lib/security/cacerts -storepass changeit -alias rds-ca-2019-root
keytool -importcert -noprompt -file /tmp/rds-combined-ca-bundle.pem -keystore /usr/local/java/lib/security/cacerts -storepass changeit -alias rds-combined-ca-bundle