Skip to content
24 changes: 23 additions & 1 deletion source/fundamentals/authentication/mechanisms.txt
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,29 @@ The driver checks for your credentials in the following sources in order:

export AWS_WEB_IDENTITY_TOKEN_FILE=<absolute path to file containing your OIDC token>

After you've set the preceding environment variable, specify the ``MONGODB-AWS``
AWS recommends using regional AWS STS endpoints instead of global
endpoints to reduce latency, build-in redundancy, and increase session token validity.
To set the AWS region, set `AWS_REGION <https://docs.aws.amazon.com/sdkref/latest/guide/feature-region.html>`__
and `AWS_STS_REGIONAL_ENDPOINTS <https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html>`__
as environment variables, as shown in the following example:

.. code-block:: bash

export AWS_STS_REGIONAL_ENDPOINTS=regional // Enables regional endpoints
export AWS_REGION=us-east-1 // Sets your AWS region

If both these environment variables aren't set, the default region is
``us-east-1``. For a list of available AWS regions, see the
`Regional Endpoints <https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints>`__
section of the AWS Service Endpoints reference in the AWS documentation.

.. warning:: Consult your SDK's Documentation for Setting an AWS Region

You cannot set your AWS region with environment variables for all SDKs,
as in the above example. See your SDK's specific documentation for
configuring an AWS region.

After you've set the preceding environment variables, specify the ``MONGODB-AWS``
authentication mechanism in your connection string as shown in the following example:

.. literalinclude:: /code-snippets/authentication/aws-env-variable.js
Expand Down