Solving the Confused Deputy Problem

The confused deputy problem occurs when a privileged entity can be coerced to perform actions on behalf of less privileged entities. In MongoDB Kafka connector deployments on shared infrastructure, this manifests when the Kafka role can assume roles from multiple AWS accounts, potentially allowing unauthorized cross-account data access. The solution involves enhancing the AwsAssumeRoleCredentialProvider class to use external IDs derived from topic names or database/collection combinations, which must be specified in the trust relationship conditions of assumed roles.