PYTHON-3906 Use AWS Secrets for Atlas tests

.evergreen/config.yml

@@ -98,7 +98,7 @@ functions:
             # If this was a patch build, doing a fresh clone would not actually test the patch
             cp -R ${PROJECT_DIRECTORY}/ $DRIVERS_TOOLS
           else
-            git clone https://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
+            git clone -b DRIVERS-2585 https://github.com/NoahStapp/drivers-evergreen-tools.git $DRIVERS_TOOLS
           fi
           echo "{ \"releases\": { \"default\": \"$MONGODB_BINARIES\" }}" > $MONGO_ORCHESTRATION_HOME/orchestration.config
 
@@ -534,40 +534,21 @@ functions:
           PYTHON_BINARY=${PYTHON_BINARY} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-enterprise-auth-tests.sh
 
   "run atlas tests":
-    - command: shell.exec
-      type: test
+    - command: ec2.assume_role
       params:
-        silent: true
-        working_dir: "src"
-        script: |
-          cat <<EOT > prepare_atlas_connectivity.sh
-          export ATLAS_FREE='${atlas_free}'
-          export ATLAS_REPL='${atlas_repl}'
-          export ATLAS_SHRD='${atlas_shrd}'
-          export ATLAS_TLS11='${atlas_tls11}'
-          export ATLAS_TLS12='${atlas_tls12}'
-          export ATLAS_SERVERLESS='${atlas_serverless}'
-          export ATLAS_SRV_FREE='${atlas_srv_free}'
-          export ATLAS_SRV_REPL='${atlas_srv_repl}'
-          export ATLAS_SRV_SHRD='${atlas_srv_shrd}'
-          export ATLAS_SRV_TLS11='${atlas_srv_tls11}'
-          export ATLAS_SRV_TLS12='${atlas_srv_tls12}'
-          export ATLAS_SRV_SERVERLESS='${atlas_srv_serverless}'
-          EOT
+        role_arn: ${aws_test_secrets_role}
     - command: shell.exec
       type: test
       params:
+        add_expansions_to_env: true
         working_dir: "src"
         script: |
           # Disable xtrace for security reasons (just in case it was accidentally set).
           set +x
-
-          . ./prepare_atlas_connectivity.sh
-          rm -f ./prepare_atlas_connectivity.sh
-
           set -o errexit
           set -o xtrace
-          ${PYTHON_BINARY} -m tox -m test-atlas
+
+          bash ${PROJECT_DIRECTORY}/.evergreen/tox.sh -m test-atlas -- -r us-west-2 drivers/test
 
   "add aws auth variables to file":
     - command: shell.exec

.evergreen/run-mongodb-oidc-test.sh

@@ -48,7 +48,7 @@ fi
 # show test output
 set -x
 
-# Workaround macOS python 3.9 incompatibility with system virtualenv.
+ Workaround macOS python 3.9 incompatibility with system virtualenv.
 if [ "$(uname -s)" = "Darwin" ]; then
     VIRTUALENV="/Library/Frameworks/Python.framework/Versions/3.9/bin/python3 -m virtualenv"
 else

.gitignore

@@ -17,3 +17,5 @@ mongocryptd.pid
 .idea/
 .nova/
 venv/
+secrets-expansion.yml
+secrets-export.sh

tox.ini

@@ -40,6 +40,7 @@ labels = # Use labels and -m instead of -e so that tox -m <label> fails instantl
     linkcheck = linkcheck
     test-atlas = test-atlas
     test-mockupdb = test-mockupdb
+    aws-secrets = aws-secrets
 
 [testenv:test]
 description = run base set of unit tests with no extra functionality
@@ -144,12 +145,14 @@ commands =
     sphinx-build -E -b linkcheck doc ./doc/_build/linkcheck
 
 [testenv:test-atlas]
-description = run atlas connection tests
 deps =
-     {[testenv:test]deps}
+    {[testenv:aws-secrets]deps}
+    {[testenv:test]deps}
 passenv = *
+allowlist_externals = bash
 commands =
-    python -m pytest -v {posargs} ./test/atlas/test_connection.py
+    {[testenv:aws-secrets]commands}
+    bash -c "source ./secrets-export.sh; python -m pytest -v ./test/atlas/test_connection.py"
 
 [testenv:test-mockupdb]
 description = run mockupdb tests
@@ -159,3 +162,11 @@ deps =
 passenv = *
 commands =
     python -m pytest -v {posargs} ./test/mockupdb
+
+[testenv:aws-secrets]
+deps =
+    PyYAML
+    boto3
+passenv = *
+commands =
+    python {env:DRIVERS_TOOLS}/.evergreen/auth_aws/setup_secrets.py {posargs}