chore: Updates package aws-sdk-go to aws-sdk-go-v2 by maastha · Pull Request #1467 · mongodb/mongodbatlas-cloudformation-resources

maastha · 2025-10-29T01:40:52Z

Proposed changes

Jira ticket: CLOUDP-339863

Updates package aws-sdk-go to aws-sdk-go-v2.

NOTE: Remaining resources are being addressed in a follow-up PR.

Link to any related issue(s):

Type of change:

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as
expected)
This change requires a documentation update
If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Manual QA performed:

cfn invoke for each of CRUDL/cfn test
Updated resource in example
Published to AWS private registry
Used the template in example to create and update a stack in AWS
Deleted stack to ensure resources are deleted
Created multiple resources in same stack
Validated in Atlas UI
Included screenshots

Required Checklist:

I have signed the MongoDB CLA
I have added tests that prove my fix is effective or that my feature works
I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
I have added any necessary documentation (if appropriate)
I have run make fmt and formatted my code
For CFN Resources: I have released by changes in the private registry and proved by change
works in Atlas

Further comments

This reverts commit 3311dc3.

maastha · 2025-11-24T23:12:18Z


-	secretsManagerClient := secretsmanager.New(req.Session)
+	// Create AWS SDK v2 config using CloudFormation handler's SDK v1 session credentials
+	cfg := awsconfig.FromHandlerRequest(req)


When migrating to AWS SDK v2, we can't use config.LoadDefaultConfig() directly in CloudFormation resource handlers to access the secret profile.

The cloudformation-cli-go-plugin provides credentials via handler.Request.Session, which is an AWS SDK v1 session. These credentials have the permissions defined in our resource execution roles (e.g., Secrets Manager access). Using LoadDefaultConfig() would use the Lambda's base execution role instead, which lacks these permissions returning below error:

CREATE_FAILED - Resource handler returned message: "operation error Secrets Manager: GetSecretValue, https response error StatusCode: 400, RequestID: ..., api error AccessDeniedException: User: arn:aws:sts::......:assumed-role/UluruResourceHandlerLambdaExecutionRole-XXXXXXXXdub/MongoDB-Atlas-ClusterXXXXXXXXXXXX-Handler-d1r20rzp5ivm is not authorized to perform: secretsmanager:GetSecretValue on resource: cfn/atlas/profile/XXXXXXXXXXX because no identity-based policy allows the secretsmanager:GetSecretValue action"

To fix this, we extract credentials from the SDK v1 session and create an SDK v2 config in awsconfig.FromHandlerRequest(req).

Alternative would be to keep AWS SDK v1 specifically for AWS service calls that require handler session (Secrets Manager, EC2, etc.) while using SDK v2 elsewhere. However, this would mean maintaining both SDK versions long-term. The current approach allows us to fully migrate to SDK v2 now and simply remove the awsconfig.FromHandlerRequest code once cloudformation-cli-go-plugin adds native SDK v2 support.

Next steps:

✅ Check with AWS on alternatives to using cloudformation-cli-go-plugin that still relies on aws-sdk-go (v1) or plans to update it.

created Support for AWS SDK for Go v2 in handler.Request aws-cloudformation/cloudformation-cli-go-plugin#237

Maybe we can add more of this explanation in the comment? Also, does this mean we will anyway depend on aws-sdk-go indirectly via the cloudformation-cli-go-plugin plugin? Do we need a ticket to track when they upgrade?

Also, does this mean we will anyway depend on aws-sdk-go indirectly via the cloudformation-cli-go-plugin plugin?

Yes. The last release was in 2023 and last commit was also 2 years ago so I doubt it's being maintained & I haven't come across an alternative.

Added a next step to my previous comment but will wait to be aligned with the team.

Agree with Espen we can capture this context in a comment, also the associated GH issue which was created aws-cloudformation/cloudformation-cli-go-plugin#237

…ntadl.json

maastha · 2025-11-25T13:29:20Z

+// The cloudformation-cli-go-plugin provides credentials via handler.Request.Session,
+// which is an AWS SDK v1 session. This function bridges those credentials to SDK v2
+// using a provider that fetches credentials on each AWS API call.
+func FromHandlerRequest(req *handler.Request) aws.Config {


main change

maastha · 2025-11-25T13:29:50Z

 	return eMap, nil
 }

-func CreateSSManagerClient(curSession *session.Session) (*ssm.SSM, error) {


the methods removed in this file are unused

Copilot

Pull request overview

This PR migrates from AWS SDK Go v1 (aws-sdk-go) to AWS SDK Go v2 (aws-sdk-go-v2) for CloudFormation resources. The primary changes involve updating import paths, adapting to the new SDK's API patterns (including adding context.Context parameters to AWS service calls), and converting between SDK v1 and v2 types (particularly for error codes and AWS utility functions).

Key Changes:

Updated import paths from github.com/aws/aws-sdk-go to github.com/aws/aws-sdk-go-v2
Added context parameters to AWS SDK service calls (Secrets Manager, CloudFormation types)
Created new awsconfig package to bridge CloudFormation handler's SDK v1 session credentials to SDK v2 configuration
Converted CloudFormation error code constants to string type using types.HandlerErrorCode* enums
Replaced AWS SDK v1 utility functions (aws.IntValue, aws.BoolValue) with SDK v2 equivalents (aws.ToInt, aws.ToBool) or custom utilities
Removed unused SSM-related functions (CreateSSManagerClient, Get, buildKey)

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cfn-resources/util/validator/validator.go	Updated CloudFormation types import and error code usage
cfn-resources/util/util.go	Updated AWS SDK imports, error codes, and removed unused SSM functions
cfn-resources/util/progressevent/failed_event.go	Converted error codes to string type using SDK v2 types
cfn-resources/util/deployment_secret.go	Added context parameters and migrated to SDK v2 Secrets Manager client
cfn-resources/util/cluster_common.go	Updated error code handling to SDK v2 types
cfn-resources/util/awsconfig/awsconfig.go	New package providing SDK v1 to v2 credentials bridge
cfn-resources/util/aws/utils.go	Updated error code type conversions
cfn-resources/search-deployment/cmd/resource/resource.go	Reordered imports and updated error code handling
cfn-resources/project/cmd/resource/resource.go	Added nil checks before accessing response status codes and updated error codes
cfn-resources/profile/profile.go	Migrated to SDK v2 Secrets Manager with context support
cfn-resources/go.mod	Added SDK v2 dependencies for secretsmanager and ssm
cfn-resources/custom-dns-configuration-cluster-aws/cmd/resource/resource.go	Updated error code handling and reordered imports
cfn-resources/custom-db-role/cmd/resource/resource.go	Updated error code type conversion
cfn-resources/cluster/cmd/resource/resource.go	Migrated AWS SDK imports and error codes
cfn-resources/cluster/cmd/resource/mappings.go	Updated error code handling
cfn-resources/cluster-outage-simulation/cmd/resource/resource.go	Updated AWS SDK imports and error codes
cfn-resources/cloud-backup-snapshot/cmd/resource/resource.go	Replaced deprecated `aws.BackgroundContext()` with `context.Background()`
cfn-resources/cloud-backup-schedule/cmd/resource/resource.go	Migrated AWS utility functions from SDK v1 to v2 equivalents
cfn-resources/cloud-backup-restore-jobs/cmd/resource/resource.go	Updated AWS utility function calls and error codes
cfn-resources/auditing/cmd/resource/resource.go	Migrated AWS SDK imports and boolean utility functions
cfn-resources/api-key/cmd/resource/resource.go	Updated error code handling
cfn-resources/alert-configuration/cmd/resource/resource.go	Updated AWS SDK imports and error codes
cfn-resources/access-list-api-key/cmd/resource/resource.go	Updated error code handling

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

EspenAlbert

A bit tricky to follow the changes and what alternatives where considered and next steps. But seems like you have tested and considered other alternatives 👍

AgustinBettati

LGTM

maastha · 2025-11-26T21:04:20Z

cluster-outage-simluation tests failing due to current cloud-dev issues related to cluster creation. Merging this PR.
I will be addressing this comment in the follow-up PR.

maastha added 16 commits October 29, 2025 07:09

init

9306513

util

bb8cc0b

c

b7e70b0

Merge branch 'master' into CLOUDP-339863-aws-sdk-v2

e9e6037

deps

6f849a1

e2e

fa48c8a

fmt

0fe1805

cred

3311dc3

Revert "cred"

b3b5d0f

This reverts commit 3311dc3.

profile

516b982

profile v2

197a5e5

Merge branch 'master' into CLOUDP-339863-aws-sdk-v2

f121066

nit

9e6405a

nit2

8bb8d40

oa

2b28863

lint

d7ad5a3

maastha commented Nov 24, 2025

View reviewed changes

maastha and others added 2 commits November 24, 2025 18:13

lint

139142f

Delete cfn-resources/private-endpoint-adl/mongodb-atlas-privateendpoi…

d11c6d8

…ntadl.json

maastha changed the title ~~chore: Updates package aws-sdk-go to v2~~ chore: Updates package aws-sdk-go to aws-sdk-go-v2 Nov 24, 2025

nit

74521b7

maastha commented Nov 25, 2025

View reviewed changes

mongodb deleted a comment from semgrep-code-mongodb Bot Nov 25, 2025

nit

e2f197b

maastha marked this pull request as ready for review November 25, 2025 13:57

maastha requested a review from a team as a code owner November 25, 2025 13:57

Copilot AI review requested due to automatic review settings November 25, 2025 13:57

Copilot AI reviewed Nov 25, 2025

View reviewed changes

EspenAlbert approved these changes Nov 25, 2025

View reviewed changes

maastha and others added 3 commits November 25, 2025 23:19

Merge branch 'master' into CLOUDP-339863-aws-sdk-v2

ce37884

nit

b29f76c

Merge branch 'master' into CLOUDP-339863-aws-sdk-v2

b76a21d

AgustinBettati approved these changes Nov 26, 2025

View reviewed changes

manupedrozo approved these changes Nov 26, 2025

View reviewed changes

maastha added this pull request to the merge queue Nov 26, 2025

Merged via the queue into master with commit acf52ac Nov 26, 2025
133 of 145 checks passed

maastha deleted the CLOUDP-339863-aws-sdk-v2 branch November 26, 2025 21:08

maastha mentioned this pull request Nov 29, 2025

chore: Updates package aws-sdk-go to aws-sdk-go-v2 - follow up #1491

Merged

19 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Updates package aws-sdk-go to aws-sdk-go-v2#1467

chore: Updates package aws-sdk-go to aws-sdk-go-v2#1467
maastha merged 23 commits intomasterfrom
CLOUDP-339863-aws-sdk-v2

maastha commented Oct 29, 2025 •

edited

Loading

Uh oh!

maastha Nov 24, 2025 •

edited

Loading

Uh oh!

EspenAlbert Nov 25, 2025

Uh oh!

maastha Nov 25, 2025 •

edited

Loading

Uh oh!

AgustinBettati Nov 26, 2025

Uh oh!

maastha Nov 25, 2025

Uh oh!

maastha Nov 25, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

EspenAlbert left a comment

Uh oh!

AgustinBettati left a comment

Uh oh!

maastha commented Nov 26, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

maastha commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

Type of change:

Manual QA performed:

Required Checklist:

Further comments

Uh oh!

maastha Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

EspenAlbert Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

maastha Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AgustinBettati Nov 26, 2025

Choose a reason for hiding this comment

Uh oh!

maastha Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

maastha Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes:

Reviewed changes

Uh oh!

EspenAlbert left a comment

Choose a reason for hiding this comment

Uh oh!

AgustinBettati left a comment

Choose a reason for hiding this comment

Uh oh!

maastha commented Nov 26, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

maastha commented Oct 29, 2025 •

edited

Loading

maastha Nov 24, 2025 •

edited

Loading

maastha Nov 25, 2025 •

edited

Loading