# IAM Authentication > Depth-first rabbithole dossier for IAM Authentication; source-anchored research pack. Parent: [MongoDB Atlas AWS Networking](https://llms-explorer.com/tree/mongodb-atlas-aws-networking/) · 3 facets · 12 facts · page: https://llms-explorer.com/tree/iam-authentication/ ## How it works - [low] The required AWS SDK now fetches credentials using the environment, endpoints, or a custom credential provider, removing the ability to provide credentials when using MONGODB-AWS authentication. (verified as of 2026-10-15) Sources: https://github.com/mongodb/node-mongodb-native/pull/4689 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] For AWS authentication, all client URIs must now be specified without credentials in the URI or options when the auth mechanism is MONGODB-AWS, such as: const client = new MongoClient('mongodb+srv://:/?authMechanism=MONGODB-AWS'); (verified as of 2026-10-15) Sources: https://github.com/mongodb/node-mongodb-native/pull/4689 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [low] You cannot set up authentication for AWS IAM principals when LDAP authorization is enabled. Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#antipatterns` ## Facts and statements - [medium] MongoDB Atlas supports AWS IAM authentication for clusters running MongoDB version 7.0 or higher, allowing users to authenticate database users to Atlas clusters using AWS IAM Users or Roles without managing passwords. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md, https://www.mongodb.com/docs/atlas/manage-connections-aws-lambda.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] To connect to Atlas using AWS IAM authentication with the mongosh shell, you must use shell version v0.9.0 or higher. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] The connection URI for AWS IAM authentication requires the authMechanism query parameter to be MONGODB-AWS and the authSource query parameter to be $external, which is URL-encoded as %24external. Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] Before clients can connect using AWS IAM database authentication, you must create database users that are configured for IAM authentication. Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] With AWS IAM authentication, Atlas accesses AWS Lambda through an assumed IAM role, eliminating the need for credentials in your connection. Sources: https://www.mongodb.com/docs/atlas/manage-connections-aws-lambda.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] Atlas uses AWS Security Token Service (STS) to verify the identity of IAM users and roles, ensuring that the authentication secret key is not received by Atlas over the wire and is not persisted by the driver. Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] You must assign an IAM role to Lambda, EC2, ECS, or EKS in the AWS console to enable authentication. Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] You can use AWS IAM credentials, using your access key ID as your username and your secret key as your password, to authenticate to Atlas. Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` - [low] For AWS Lambda and HTTP services (ECS and EC2), drivers automatically read credentials from environment variables, whereas for AWS EKS, you must manually assign the IAM role. Sources: https://www.mongodb.com/docs/atlas/security/aws-iam-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/iam-authentication-7d5dd5904a/rabbithole-synthesis.md#core` ## Related concepts - IAM — is a part of IAM Authentication - Authentication — is a part of IAM Authentication