What problem are you trying to solve?

Focus on the what and why of the need you have, not the how you'd like it solved.

Vault's MongoDB Atlas database plugin, which issues short-lived Atlas database users, can only authenticate to the Atlas Administration API with a programmatic API key. MongoDB recommends service accounts instead of API keys, but anyone using this plugin still has to create and keep a long-lived API key just for Vault.

What would you like to see happen?

Describe the desired outcome or enhancement.

The Vault MongoDB Atlas database plugin supports Atlas service accounts (OAuth 2.0 client credentials) as an alternative to API keys, with existing API key setups unchanged.

I've opened a pull request that does this, tested with Vault 2.2.0 against a real Atlas project:
- Pull request: https://github.com/hashicorp/vault-plugin-database-mongodbatlas/pull/125
- Issue: https://github.com/hashicorp/vault-plugin-database-mongodbatlas/issues/124

Help from MongoDB in getting it reviewed and merged by the plugin maintainers would be much appreciated.

Why is this important to you or your team?

Explain how the request adds value or solves a business need.

It lets Vault users follow MongoDB's own recommendation for Atlas Administration API access. Service accounts use short-lived access tokens (1 hour) instead of sending a long-lived key pair, and they're the direction MongoDB is taking. Without plugin support, Vault is one of the remaining reasons to keep programmatic API keys around.

What steps, if any, are you taking today to manage this problem?

Keeping a programmatic API key only for Vault, and contributing service account support to the plugin through the pull request above.