无法将 AWS IAM 角色与 KMS 提供程序一起用于 MongoDB 客户端字段级加密？

Question

I am using EC2 Instance profile credentials for allowing the AWS EC2 instance to access other AWS services.

Recently, I implemented MongoDB Client-Side Field-Level Encryption for which the AWS KMS has been used as KMS Providers. The MongoDB Documentation for CSFLE mentions that the KMS Provider should have secret key and access key that maps to an IAM User.

This way I will have to create another IAM User and then maintain those credentials separately. A simpler way (and more secure) would have been to use the DefaultCredentialsProvider from software.amazon.awssdk:auth and that could have used the credentials from the instance profile that could have given access to the KMS. But this does not work for me and MongoClient fails as KMS rejects the security token used.

Is there any reason behind not allowing this way of accessing KMS?

Answer 1

As all projects, initial implementation of CSFLE had a scope. This scope did not include the ability to use instance roles for credential identification.

I suggest you submit your request to https://feedback.mongodb.com/ for consideration.