IAM Role Atlas API Access
Parent: Global AI Hub Research Corpus · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-c4a6ec456644-pending
↓ Facts as markdownall context files
Source-anchored research for IAM Role Atlas API Access. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- For application database access, register the AWS IAM role as an Atlas database user and grant database privileges. MONGODB-AWS connections use authSource=$external; a temporary STS credential set includes an access key, secret key and session token. Gridcog demonstrates this database connection flow from Lambda. (high confidence) [source]
- IAM database connections use MONGODB-AWS with authSource=$external. Gridcog's implementation obtains temporary credentials through STS AssumeRole and includes AWS_SESSION_TOKEN when constructing the MongoClient connection. (high confidence) [source]
- MongoDB recommends service accounts over legacy API keys for Administration API automation. Service accounts use the OAuth 2.0 client-credentials flow with an Atlas client ID and rotatable secret; assigning an AWS workload role alone does not provide these credentials. (low confidence) (verified as of 2026-10-14) [source]
Comparisons and alternatives
- An application can authenticate to an Atlas cluster with an AWS IAM role after creating an IAM-configured database user for that role. This is database authentication, rather than Administration API authentication. (high confidence) [source]
- For Atlas access to AWS, the trust policy identifies the assuming principal and requires the external ID; the role's permission policy determines its AWS resource access. AWS describes external IDs as protection against the confused-deputy problem, rather than secrets. (high confidence) [source]
Facts and statements
- Atlas documents service-account OAuth 2.0 access tokens and HTTP Digest API keys for direct Administration API requests. AWS IAM database credentials are not a documented substitute for those credentials. The Administration API manages deployments and database users; it does not read or write cluster data. (high confidence) (verified as of 2026-10-23) [source]
- Unified AWS access lets Atlas assume a role in the customer's AWS account for features such as Data Federation and encryption at rest. The Administration API or UI configures that integration; this does not establish IAM-role login to the Administration API. (high confidence) [source]
- Unified AWS Access setup first creates a cloudProviderAccess role record, then configures the customer role trust policy with the returned atlasAWSAccountArn principal, sts:AssumeRole action and atlasAssumedRoleExternalId condition, and finally authorizes the customer role ARN. The returned roleId identifies the integration for Atlas services. (low confidence) [source]
- The external ID in a third-party role trust policy limits the circumstances in which the trusted party may assume the role and mitigates the confused deputy problem. Atlas includes this condition in its Unified AWS Access example; AWS says an external ID is not a secret. (high confidence) [source]
- The Atlas Terraform provider can assume an AWS role to retrieve an Atlas service-account secret or API-key pair from AWS Secrets Manager. Its assume_role setting configures access to that secret; the retrieved Atlas credentials still authenticate provider operations. (high confidence) (verified as of 2026-10-23) [source]
- A community report dated April 14, 2023 traced a 404 while deleting an IAM-role database user to an unescaped slash in the role ARN path parameter. The reporter corrected the initial API-bug attribution to a URL-encoding/documentation problem. This is historical troubleshooting evidence, not proof of a current API defect. (low confidence) [source]
- Before deauthorizing a Unified AWS Access role, remove the Atlas services associated with it. (low confidence) [source]
- A mirrored MongoDB status timeline reports a July 9, 2026 IAM-authentication configuration incident affecting Data Federation and Online Archive queries against backing Atlas clusters. It identified SCRAM as a temporary workaround and reported resolution that day; this does not establish an Administration API authentication outage. (low confidence) [source]
- The documented machine authentication methods for the Atlas Administration API are OAuth 2.0 service-account access tokens and HTTP Digest API keys. AWS IAM role credentials are not listed as a direct authentication method. (high confidence) (verified as of 2026-10-23) [source]
- The Atlas Administration API manages resources and database users but does not read or write cluster data; database access requires a separately authorized database user. (high confidence) [source]
Children
- Atlas Administration API service-account authentication (frontier)
- Atlas Unified AWS Access trust policy (frontier)
- MONGODB-AWS database authentication (frontier)
- IAM role ARN URL encoding (frontier)
Frontier under this node: Atlas Administration API service-account authentication, Atlas Unified AWS Access trust policy, IAM role ARN URL encoding, MONGODB-AWS database authentication