Getting "OperationFailure: bad auth" after updating to v1.1.0

[chanshing]

After updating to v1.1.0 I'm getting the following error:

OperationFailure: bad auth : user arn:aws:iam::111222333444:user/Shing is not found, full error: {'ok': 0, 'errmsg': 'bad auth : user arn:aws:iam::111222333444:user/Shing is not found', 'code': 8000, 'codeName': 'AtlasError'}

It happens after I instantiate the client and call .list_database_names():

HOST = f"mongodb+srv://{MY_MONGO_URL_DOT_NET}/?authSource=%24external&authMechanism=MONGODB-AWS&retryWrites=true&w=majority"

client = MongoClient(HOST, server_api=ServerApi('1'))

client.list_database_names()

[blink1073]

Hi @chanshing, in v1.1.0 we switched to using boto3 to fetch credentials, which includes getting credentials in a different search order and in more locations than was previously used.

Most likely you have credentials for 111222333444:user/Shing in ~/.aws/credentials that are getting picked up. See Configuring Credentials.

I tried your snippet locally, where I have credentials in ~/.aws/credentials for my Atlas user, and was able to connect.

[chanshing]

Thank you @blink1073 for the quick reply. Yes, I have a ~/.aws/credentials file with aws_access_key_id and aws_secret_access_key set. When I removed the file it worked fine. Thanks!

But what's the recommended way to keep ~/.aws/credentials file and still have my mongo script working? I need the credentials file for other programs.

[blink1073]

You can set AWS_PROFILE="" in your shell or add os.environ["AWS_PROFILE"] = "" to your script. Alternatively, you can create an AWS profile specifically for your Atlas credentials and set AWS_PROFILE to that profile name. We'll update the docs accordingly.

[blink1073]

Documentation update is in #16

[chanshing]

When I set os.environ["AWS_PROFILE"] = "" in my script, I get:

OperationFailure: temporary MONGODB-AWS credentials could not be obtained (pymongo-auth-aws version 1.1.0)

Based on your advice, I created an empty profile [mongo] in my credentials file:

[default]
aws_access_key_id = ...
aws_secret_access_key = ...

[prod]
aws_access_key_id = ...
aws_secret_access_key = ...

[mongo]

Also in the config file:

[default]
region = us-east-1
output = json

[prod]
region = us-east-1
output = json

[mongo]

Then in my script, setting os.environ["AWS_PROFILE"] = 'mongo' works.
I'll use this approach for now. Thanks!

[blink1073]

I can confirm, thanks for following up, apologies for the confusion! We'll update the documentation.

[blink1073]

#17