Use x509 cert to connect to a service

Question

I am trying to connect to MongoDB using X509 certificates from an EC2 instance. I initially stored .pem file for cert on EC2 instance and was able to connect directly using that:

mongo --tls --tlsCertificateKeyFile mycert.pem --tlsCAFile password  --authenticationDatabase '$external' --authenticationMechanism MONGODB-X509

Now I am trying to secure the key so it is not stored inside EC2 instance. I know I cannot use ACM for this purpose. So I saved mycert.pem on IAM, but I am not sure how to use it. I can get the cert:

aws iam get-server-certificate mycert

But how can I use mycert to connect to Mongo in above scenario?

user_9540925 · Answer

Now I am trying to secure the key so it is not stored inside EC2 instance.

The key must be stored inside the instance, since the instance must use it.

You can store it in memory by creating a tmpfs partition and writing it to that partition as a file.

user_1058646 · Answer

Followed Mark B's direction and used AWS SecretsManager instead of IAM for saving X509 cert.

Use x509 cert to connect to a service

2 Answers