RUBY-2732 Add service account support (#2681)

Author: comandeo-mongo

source/reference/authentication.txt

@@ -280,6 +280,7 @@ Temporary credentials are used with:
 - `EC2 instance roles <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html>`_.
 - `ECS task roles <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html>`_.
 - `AWS Lambda environment <https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html>`_.
+- `IAM roles for service accounts <https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html>`_.
 
 The Ruby driver allows providing both regular and temporary credentials
 explicitly as Ruby options or URI options. If credentials are not explicitly
@@ -362,6 +363,18 @@ the specified order:
   a variety of AWS-related libraries and tools such as the official
   AWS Ruby SDK and the AWS CLI. They are also defined when running in an
   AWS Lambda environment.
+- The AWS STS `AssumeRoleWithWebIdentity action
+  <https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html>`_.
+  This returns credentials associated with the service account token. This mechanism
+  requires the following environment variables to be set:
+
+  - ``AWS_WEB_IDENTITY_TOKEN_FILE`` - path to a file containing the service
+    account token.
+  - ``AWS_ROLE_ARN`` - the Amazon Resource Name (ARN) of the role that the
+    caller is assuming.
+  - ``AWS_ROLE_SESSION_NAME`` (optional) - An identifier for the assumed role
+    session. If omitted, a random name will be generated by the driver.
+
 - The AWS `ECS task metadata endpoint
   <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html>`_.
   This returns credentials associated with the ECS task role assigned to

source/release-notes.txt

@@ -29,6 +29,7 @@ This release includes the following new features:
   client side encryption.
 - Added support for automatic GCP credentials retrieval when Google Cloud Key
   Management is used for client side encryption.
+- Added support for AWS IAM Roles for service accounts, EKS in particular.
 
 
 .. _release-notes-2.18: