Amazon DocumentDB 环境搭建 #

账户准备：
├── 拥有AWS账户
├── 配置计费信息
├── 设置IAM用户和权限
├── 选择合适的区域
└── 了解服务配额

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "docdb:CreateDBCluster",
        "docdb:CreateDBInstance",
        "docdb:DescribeDBClusters",
        "docdb:DescribeDBInstances",
        "docdb:DeleteDBCluster",
        "docdb:DeleteDBInstance"
      ],
      "Resource": "*"
    }
  ]
}

VPC配置：
├── 创建或选择VPC
├── 配置子网（至少2个AZ）
├── 创建安全组
├── 配置路由表
└── 设置网络ACL

操作路径：
AWS控制台 → 数据库 → Amazon DocumentDB → 创建集群

集群配置：
├── 集群标识符：my-docdb-cluster
├── 引擎版本：5.0.0（推荐）
├── 实例类：db.r6g.large
├── 实例数量：1主 + 2只读副本
├── 主用户名：admin
├── 主密码：********
└── 认证：密码认证

网络设置：
├── VPC：选择已创建的VPC
├── 子网组：选择或创建子网组
├── 安全组：配置安全组规则
└── 可用区：选择多个AZ

高级设置：
├── 集群参数组：default.docdb5.0
├── 加密：启用存储加密
├── 备份保留期：7天
├── 时间点恢复：启用
├── 删除保护：启用
└── 日志导出：审计日志、错误日志

aws docdb create-db-subnet-group \
  --db-subnet-group-name my-docdb-subnet-group \
  --db-subnet-group-description "My DocumentDB subnet group" \
  --subnet-ids subnet-12345678 subnet-87654321

aws docdb create-db-cluster \
  --db-cluster-identifier my-docdb-cluster \
  --engine docdb \
  --engine-version 5.0.0 \
  --master-username admin \
  --master-user-password MySecurePassword123! \
  --db-subnet-group-name my-docdb-subnet-group \
  --vpc-security-group-ids sg-12345678 \
  --backup-retention-period 7 \
  --storage-encrypted \
  --enable-cloudwatch-logs-exports '["audit","profiler"]'

aws docdb create-db-instance \
  --db-instance-identifier my-docdb-primary \
  --db-instance-class db.r6g.large \
  --engine docdb \
  --db-cluster-identifier my-docdb-cluster

aws docdb create-db-instance \
  --db-instance-identifier my-docdb-replica-1 \
  --db-instance-class db.r6g.large \
  --engine docdb \
  --db-cluster-identifier my-docdb-cluster

AWSTemplateFormatVersion: '2010-09-09'
Description: DocumentDB Cluster

Parameters:
  ClusterIdentifier:
    Type: String
    Default: my-docdb-cluster
  MasterUsername:
    Type: String
    Default: admin
  MasterUserPassword:
    Type: String
    NoEcho: true
  InstanceClass:
    Type: String
    Default: db.r6g.large
  VpcId:
    Type: AWS::EC2::VPC::Id
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>

Resources:
  DocDBSubnetGroup:
    Type: AWS::DocDB::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: DocumentDB Subnet Group
      SubnetIds: !Ref SubnetIds

  DocDBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: DocumentDB Security Group
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 27017
          ToPort: 27017
          CidrIp: 10.0.0.0/16

  DocDBCluster:
    Type: AWS::DocDB::DBCluster
    Properties:
      DBClusterIdentifier: !Ref ClusterIdentifier
      Engine: docdb
      EngineVersion: 5.0.0
      MasterUsername: !Ref MasterUsername
      MasterUserPassword: !Ref MasterUserPassword
      DBSubnetGroupName: !Ref DocDBSubnetGroup
      VpcSecurityGroupIds:
        - !Ref DocDBSecurityGroup
      StorageEncrypted: true
      BackupRetentionPeriod: 7

  DocDBPrimaryInstance:
    Type: AWS::DocDB::DBInstance
    Properties:
      DBClusterIdentifier: !Ref DocDBCluster
      DBInstanceClass: !Ref InstanceClass
      Engine: docdb

Outputs:
  ClusterEndpoint:
    Description: DocumentDB Cluster Endpoint
    Value: !GetAtt DocDBCluster.Endpoint

安全组入站规则：
├── 类型：自定义TCP
├── 端口：27017
├── 源：应用服务器安全组或IP
└── 描述：DocumentDB访问

aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 27017 \
  --source-group sg-87654321

# 获取集群信息
aws docdb describe-db-clusters \
  --db-cluster-identifier my-docdb-cluster

# 输出示例
{
  "DBClusters": [
    {
      "Endpoint": "my-docdb-cluster.cluster-abc123.us-east-1.docdb.amazonaws.com",
      "Port": 27017,
      "MasterUsername": "admin"
    }
  ]
}

# Ubuntu/Debian
wget -qO - https://www.mongodb.org/static/pgp/server-5.0.asc | sudo apt-key add -
echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu focal/mongodb-org/5.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-5.0.list
sudo apt update
sudo apt install -y mongodb-org-shell

# macOS
brew tap mongodb/brew
brew install mongodb-community-shell

# 基本连接
mongo --ssl \
  --host my-docdb-cluster.cluster-abc123.us-east-1.docdb.amazonaws.com:27017 \
  --username admin \
  --password

# 连接字符串
mongo "mongodb://admin:password@my-docdb-cluster.cluster-abc123.us-east-1.docdb.amazonaws.com:27017/?ssl=true&replicaSet=rs0&readPreference=secondaryPreferred"

const { MongoClient } = require('mongodb');

const uri = "mongodb://admin:password@my-docdb-cluster.cluster-abc123.us-east-1.docdb.amazonaws.com:27017/?ssl=true&replicaSet=rs0&readPreference=secondaryPreferred";

const client = new MongoClient(uri, {
  tls: true,
  tlsCAFile: './rds-combined-ca-bundle.pem'
});

async function connect() {
  try {
    await client.connect();
    console.log('Connected to DocumentDB');
    
    const db = client.db('mydb');
    const collection = db.collection('users');
    
    return client;
  } catch (error) {
    console.error('Connection error:', error);
    throw error;
  }
}

module.exports = { connect, client };

from pymongo import MongoClient
from pymongo.errors import ConnectionFailure

uri = "mongodb://admin:password@my-docdb-cluster.cluster-abc123.us-east-1.docdb.amazonaws.com:27017/?ssl=true&replicaSet=rs0&readPreference=secondaryPreferred"

client = MongoClient(
    uri,
    tls=True,
    tlsCAFile='./rds-combined-ca-bundle.pem'
)

try:
    client.admin.command('ping')
    print("Connected to DocumentDB")
except ConnectionFailure:
    print("Connection failed")

db = client['mydb']
collection = db['users']

import com.mongodb.client.MongoClients;
import com.mongodb.client.MongoClient;
import com.mongodb.client.MongoDatabase;

public class DocumentDBConnection {
    public static void main(String[] args) {
        String uri = "mongodb://admin:password@my-docdb-cluster.cluster-abc123.us-east-1.docdb.amazonaws.com:27017/?ssl=true&replicaSet=rs0&readPreference=secondaryPreferred";
        
        try (MongoClient mongoClient = MongoClients.create(uri)) {
            MongoDatabase database = mongoClient.getDatabase("mydb");
            System.out.println("Connected to DocumentDB");
        }
    }
}

# 下载RDS证书包
wget https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem

# 或使用curl
curl -O https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem

// Node.js
const client = new MongoClient(uri, {
  tls: true,
  tlsCAFile: '/path/to/rds-combined-ca-bundle.pem',
  tlsAllowInvalidCertificates: false
});

# Python
client = MongoClient(
    uri,
    tls=True,
    tlsCAFile='/path/to/rds-combined-ca-bundle.pem',
    tlsAllowInvalidCertificates=False
)

开发环境建议：
├── 使用DocumentDB本地模拟器
├── 或使用MongoDB本地实例
├── 配置环境变量
├── 使用连接池
└── 实现重试机制

# .env文件
DOCUMENTDB_URI=mongodb://admin:password@my-docdb-cluster.cluster-abc123.us-east-1.docdb.amazonaws.com:27017/?ssl=true&replicaSet=rs0
DOCUMENTDB_DATABASE=mydb
DOCUMENTDB_CA_FILE=./rds-combined-ca-bundle.pem

// Node.js连接池配置
const client = new MongoClient(uri, {
  maxPoolSize: 50,
  minPoolSize: 5,
  maxIdleTimeMS: 30000,
  waitQueueTimeoutMS: 5000,
  connectTimeoutMS: 10000,
  socketTimeoutMS: 0
});

// test-connection.js
const { MongoClient } = require('mongodb');

async function testConnection() {
  const client = new MongoClient(process.env.DOCUMENTDB_URI, {
    tls: true,
    tlsCAFile: process.env.DOCUMENTDB_CA_FILE
  });

  try {
    await client.connect();
    
    const result = await client.db('admin').command({ ping: 1 });
    console.log('Ping result:', result);
    
    const stats = await client.db('admin').command({ serverStatus: 1 });
    console.log('Server version:', stats.version);
    
    console.log('Connection successful!');
  } catch (error) {
    console.error('Connection failed:', error);
  } finally {
    await client.close();
  }
}

testConnection();

搭建步骤：
├── 1. 准备AWS账户和权限
├── 2. 配置VPC和网络
├── 3. 创建DocumentDB集群
├── 4. 配置安全组
├── 5. 下载TLS证书
├── 6. 安装客户端工具
├── 7. 测试连接
└── 8. 配置开发环境