@@ -4,6 +4,22 @@ This directory contains configuration and scripts used to run the driver's
 test suite in Evergreen, MongoDB's continuous integration system.
 
 
+## Downloading "latest" server binaries
+
+`MONGODB_VERSION=latest` (and `latest-build`) downloads an unpublished nightly
+build from MongoDB's private `origin-mongodb-server-latest` S3 bucket, so it
+requires an AWS identity. In Evergreen the global `pre` block assumes
+`aws_test_secrets_role` and `bootstrap-mongo-orchestration` forwards the
+resulting credentials into the download subprocess. Locally, including the
+Docker test runner, set `AWS_PROFILE` to a profile that has the Drivers test
+secrets credentials and refresh it with `aws sso login --profile "$AWS_PROFILE"`:
+see the drivers-evergreen-tools
+[Secrets Handling](https://github.com/mongodb-labs/drivers-evergreen-tools/blob/master/.evergreen/secrets_handling/README.md)
+docs. Any other version, such as `latest-stable` or a pinned release like
+`8.0`, is downloaded from the public hosts and needs no AWS access; that is
+also the default used by `run-mongodb.sh`.
+
+
 ## Scheduled ruby-dev build (RUBY-3731)
 
 The `ruby-dev` build variant runs the main test suite against the upcoming,
 
@@ -145,7 +145,10 @@ functions:
         env:
           MONGODB_VERSION: ${MONGODB_VERSION}
         include_expansions_in_env: [TOPOLOGY, AUTH, SSL, ORCHESTRATION_FILE,
-            REQUIRE_API_VERSION, LOAD_BALANCER]
+            REQUIRE_API_VERSION, LOAD_BALANCER,
+            # Needed to download "latest"/"latest-build" from the private S3
+            # bucket (DRIVERS-3628). Any other version needs no AWS access.
+            AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         args: ["${DRIVERS_TOOLS}/.evergreen/run-mongodb.sh", "start"]
     - command: expansions.update
       params:
@@ -166,6 +169,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           export CSOT_SPEC_TESTS=1
@@ -178,6 +184,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           export OTEL_SPEC_TESTS=1
@@ -280,6 +289,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           TEST_CMD="bundle exec rake driver_bench" PERFORMANCE_RESULTS_FILE="$PROJECT_DIRECTORY/perf.json" .evergreen/run-tests.sh
@@ -302,6 +314,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           if [ -n "${FLE}" ]; then
 
@@ -142,7 +142,10 @@ functions:
         env:
           MONGODB_VERSION: ${MONGODB_VERSION}
         include_expansions_in_env: [TOPOLOGY, AUTH, SSL, ORCHESTRATION_FILE,
-            REQUIRE_API_VERSION, LOAD_BALANCER]
+            REQUIRE_API_VERSION, LOAD_BALANCER,
+            # Needed to download "latest"/"latest-build" from the private S3
+            # bucket (DRIVERS-3628). Any other version needs no AWS access.
+            AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         args: ["${DRIVERS_TOOLS}/.evergreen/run-mongodb.sh", "start"]
     - command: expansions.update
       params:
@@ -163,6 +166,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           export CSOT_SPEC_TESTS=1
@@ -175,6 +181,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           export OTEL_SPEC_TESTS=1
@@ -277,6 +286,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           TEST_CMD="bundle exec rake driver_bench" PERFORMANCE_RESULTS_FILE="$PROJECT_DIRECTORY/perf.json" .evergreen/run-tests.sh
@@ -299,6 +311,9 @@ functions:
       params:
         shell: bash
         working_dir: "src"
+        # Needed to download "latest"/"latest-build" from the private S3
+        # bucket (DRIVERS-3628). Any other version needs no AWS access.
+        include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN]
         script: |
           ${PREPARE_SHELL}
           if [ -n "${FLE}" ]; then