[Enhancement]: Passwordless AWS IAM authentication for Amazon DocumentDB (and RDS Postgres in the RAG API)

[sadypro]

What

Let LibreChat connect to Amazon DocumentDB 5.0 using the workload's AWS IAM identity (IRSA or EKS Pod Identity on EKS, or an instance profile) instead of a database password stored in MONGO_URI. A companion change would give the RAG API the same thing for RDS/Aurora PostgreSQL (pgvector).

Why

Teams running LibreChat on EKS currently have to put a DocumentDB password in MONGO_URI and a Postgres password in POSTGRES_PASSWORD, then store and rotate those secrets. IAM authentication removes the stored secret and uses short-lived credentials that refresh automatically. DocumentDB 5.0 is already the supported target (see packages/data-schemas/misc/documentdb/documentdb-compat.md), but LibreChat has no IAM auth path today.

Proposed implementation (LibreChat)

• Opt-in env var: MONGO_AUTH_MECHANISM=aws-iam, plus an optional MONGO_AWS_ROLE_ARN to assume an extra role. When unset, behavior is unchanged.
  • It's an env var rather than librechat.yaml because connectDb() runs before app config loads, like every other MONGO_* setting.
• New packages/api/src/db/auth.ts: resolveMongoAuth({ uri, mechanism, roleArn, credentialProvider? }) returns { authMechanism: 'MONGODB-AWS', authSource: '$external', authMechanismProperties: { AWS_CREDENTIAL_PROVIDER } }.
  • The provider is fromNodeProviderChain() (or fromTemporaryCredentials when a role ARN is set) from @aws-sdk/credential-providers, which is already a dependency. The installed mongodb ^6.14 driver supports AWS_CREDENTIAL_PROVIDER.
  • The provider is injectable, so tests don't need module mocks.
• api/db/connect.js: wiring only. It merges the options in and logs a sanitized copy (never credentials). config/ scripts inherit the change through connectDb.
• Fail-fast checks at startup: an unknown mechanism, credentials still present in the URI, or an authSource other than $external each throw. When AWS credentials can't be resolved, a clear hint is logged.
• Tests: unit tests for resolveMongoAuth using a substitute provider, and a wiring test for connect.js. There's also a live test in the existing misc/documentdb harness that is skipped unless DOCUMENTDB_IAM_URI is set, because MONGODB-AWS can't run against mongodb-memory-server.
• Docs: .env.example entries, and an "IAM authentication" section in documentdb-compat.md covering the $external user, TLS bundle and retryWrites=false.

Companion change (RAG API, separate repo)

POSTGRES_AUTH_MECHANISM=aws-iam would generate an RDS IAM token (boto3 generate_db_auth_token) for each new connection on both of rag_api's connection paths: the SQLAlchemy/psycopg2 engine and the asyncpg pool. TLS is required. The only LibreChat change for this would be .env.example documentation. I'm happy to open that proposal in the rag_api repo if you'd like it tracked there.

Compatibility

• It's opt-in and off by default.
• A DocumentDB cluster can hold a password user and an IAM user side by side, so rolling deploys and rollbacks don't need a data change.

I'd like to implement this myself and can open the PR against dev once it's approved.