Connection Drivers · Amazon Documentdb · aws/agent-toolkit-for-aws · Skills Docs

Connection Drivers · Amazon Documentdb · aws/agent-toolkit-for-aws · Skills Docs

import pymongo

client = pymongo.MongoClient(
    'mongodb://admin:<password>@<endpoint>:27017/<db-name>'
    '?tls=true&tlsCAFile=global-bundle.pem&replicaSet=rs0'
    '&readPreference=secondaryPreferred&retryWrites=false'
)
db = client["<db-name>"]
db.command("ping")

const { MongoClient } = require("mongodb");

const client = new MongoClient(
  "mongodb://admin:<password>@<endpoint>:27017/<db-name>"
    + "?tls=true&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false",
  { tlsCAFile: "global-bundle.pem" }
);

await client.connect();
await client.db("admin").command({ ping: 1 });

import com.mongodb.client.MongoClient;
import com.mongodb.client.MongoClients;
import com.mongodb.ConnectionString;
import com.mongodb.MongoClientSettings;

MongoClientSettings settings = MongoClientSettings.builder()
    .applyConnectionString(new ConnectionString(
        "mongodb://admin:<password>@<endpoint>:27017/<db-name>"
        + "?ssl=true&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false"
    ))
    .applyToConnectionPoolSettings(b -> b.maxSize(10).maxWaitQueueSize(2))
    .build();
MongoClient client = MongoClients.create(settings);

mydir=/tmp/certs && truststore=${mydir}/rds-truststore.jks
# Generate a strong, unique truststore password — never hardcode one.
# Store it in Secrets Manager / Parameter Store and reference it from your app config.
storepassword=$(openssl rand -base64 24) && mkdir -p ${mydir}

curl -sS "https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem" > ${mydir}/global-bundle.pem
awk 'split_after==1{n++;split_after=0} /-----END CERTIFICATE-----/{split_after=1}{print > "rds-ca-" n ".pem"}' < ${mydir}/global-bundle.pem

for CERT in rds-ca-*; do
  alias=$(openssl x509 -noout -text -in $CERT | perl -ne 'next unless /Subject:/; s/.*(CN=|CN = )//; print')
  keytool -import -file ${CERT} -alias "${alias}" -storepass ${storepassword} -keystore ${truststore} -noprompt
  rm $CERT
done

import (
    "context"; "crypto/tls"; "crypto/x509"; "os"
    "go.mongodb.org/mongo-driver/mongo"
    "go.mongodb.org/mongo-driver/mongo/options"
)

caCert, _ := os.ReadFile("global-bundle.pem")
pool := x509.NewCertPool()
pool.AppendCertsFromPEM(caCert)
tlsConfig := &tls.Config{RootCAs: pool}

uri := "mongodb://admin:<pw>@<endpoint>:27017/<db>?replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false"
opts := options.Client().ApplyURI(uri).SetTLSConfig(tlsConfig)
client, err := mongo.Connect(context.TODO(), opts)

using MongoDB.Driver;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;

string uri = "mongodb://admin:<pw>@<endpoint>:27017/<db>?replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false";

// Load the RDS bundle into a connection-scoped collection (no system store changes)
var caCerts = new X509Certificate2Collection();
caCerts.Import("global-bundle.p7b");

var settings = MongoClientSettings.FromConnectionString(uri);
settings.UseTls = true;
settings.SslSettings = new SslSettings {
    ServerCertificateValidationCallback = (sender, cert, chain, errors) => {
        chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
        chain.ChainPolicy.CustomTrustStore.AddRange(caCerts);
        return chain.Build(new X509Certificate2(cert));
    }
};

var client = new MongoClient(settings);

client = Mongo::Client.new('mongodb://<endpoint>:27017',
  database: '<db>', replica_set: 'rs0',
  read: { mode: :secondary_preferred },
  user: 'admin', password: '<pw>',
  ssl: true, ssl_verify: true, ssl_ca_cert: 'global-bundle.pem',
  retry_writes: false)