@@ -74,12 +74,12 @@ enterprise-only feature. If you only intend to use explicit encryption, you may
74
74
skip this step.
75
75
76
76
Mongocryptd comes pre-packaged with enterprise builds of the MongoDB server
77
- (versions 4.2 and newer). For installation instructions, see
78
- `the MongoDB manual <https://docs. mongodb.com/manual/reference/security-client-side-encryption-appendix/#installation>`_.
77
+ (versions 4.2 and newer). For installation instructions, see the
78
+ `MongoDB manual <https://mongodb.com/docs /manual/reference/security-client-side-encryption-appendix/#installation>`_.
79
79
80
80
In order to configure mongocryptd (for example, which port it listens on or the
81
81
path used to spawn the daemon), it is necessary to pass different options to the
82
- ``Mongo::Client`` performing automatic encryption. See the `:extra_options`_
82
+ ``Mongo::Client`` performing automatic encryption. See the :ref: `:extra_options <cse-extra-options>`
83
83
section of this tutorial for more information.
84
84
85
85
Automatic Encryption
@@ -202,11 +202,12 @@ The example above demonstrates using automatic encryption with a local master ke
202
202
For more information about using the AWS Key Management Service to create a
203
203
master key and create data keys, see the following sections of this tutorial:
204
204
205
- - `Creating A Master Key`_
206
- - `Creating A Data Key`_
205
+ - :ref: `Creating A Master Key <creating-a-master-key>`
206
+ - :ref: `Creating A Data Key <creating-a-data-key>`
207
207
208
208
Explicit Encryption
209
209
===================
210
+
210
211
Explicit encryption is a feature that allows users to encrypt and decrypt
211
212
individual pieces of data such as strings, integers, or symbols. Explicit
212
213
encryption is a community feature and does not require an enterprise build
@@ -296,8 +297,8 @@ The example above demonstrates using explicit encryption with a local master key
296
297
For more information about using the AWS Key Management Service to create a
297
298
master key and create data keys, see the following sections of this tutorial:
298
299
299
- - `Creating A Master Key`_,
300
- - `Creating A Data Key`_,
300
+ - :ref: `Creating A Master Key <creating-a-master-key>`
301
+ - :ref: `Creating A Data Key <creating-a-data-key>`
301
302
302
303
Creating a Master Key
303
304
=====================
@@ -307,8 +308,11 @@ user data. The master key can be generated in one of two ways: by creating a
307
308
local key, or by creating a key in the Amazon Web Services Key Management
308
309
Service (AWS KMS).
309
310
311
+ .. _local-master-key:
312
+
310
313
Local Master Key
311
314
~~~~~~~~~~~~~~~~
315
+
312
316
A local master key is a 96-byte binary string. It should be persisted
313
317
on your machine as an environment variable or in a text file.
314
318
@@ -329,14 +333,25 @@ AWS Master Key
329
333
It is recommended that you use Amazon's Key Management Service to create and
330
334
store your master key. To do so, follow steps 1 and 2 of the
331
335
:drivers:`"Convert to a Remote Master Key" section</security/client-side-field-level-encryption-local-key-to-kms/#convert-to-a-remote-master-key>`
336
+ .. _remote-master-key:
337
+
338
+ Remote Master Key
339
+ ~~~~~~~~~~~~~~~~~
340
+ It is recommended that you use a remote Key Management Service to create and
341
+ store your master key. To do so, follow steps of the
342
+ `"Set up a Remote Master Key" <https://www.mongodb.com/docs/manual/core/csfle/tutorials/#set-up-a-remote-master-key>`_
332
343
in the MongoDB Client-Side Encryption documentation.
333
344
334
345
For more information about creating a master key, see the
335
346
:drivers:`Create a Master Key </security/client-side-field-level-encryption-guide/#a-create-a-master-key>`
347
+ `Create a Master Key <https://www.mongodb.com/docs/manual/core/csfle/#a.-create-a-master-key>`_
336
348
section of the MongoDB manual.
337
349
350
+ .. _creating-a-data-key:
351
+
338
352
Creating a Data Key
339
353
===================
354
+
340
355
Once you have created a master key, create a data key by calling the
341
356
``#create_data_key`` method on an instance of the ``Mongo::ClientEncryption``
342
357
class. This method generates a new data key and inserts it into the key vault
@@ -376,8 +391,8 @@ key with the following code snippet:
376
391
data_key_id = client_encryption.create_data_key('local')
377
392
# => <BSON::Binary... type=ciphertext...>
378
393
379
- See the `Local Master Key`_ section for more information about generating a new
380
- local master key.
394
+ See the :ref: `Local Master Key <local-master-key>` section for more information
395
+ about generating a new local master key.
381
396
382
397
Create a Data Key Using an AWS Master Key
383
398
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -423,18 +438,20 @@ generating a new master key on AWS and finding the information you need to
423
438
create data keys.
424
439
425
440
For more information about creating a data key, see the
426
- :drivers: `Create a Data Encryption Key </security/client-side-field-level-encryption-guide/#b -create-a-data-encryption-key>`
441
+ `Create a Data Encryption Key <https://www.mongodb.com/docs/manual/core/csfle/#b. -create-a-data-encryption-key>`_
427
442
section of the MongoDB manual.
428
443
429
444
Auto-Encryption Options
430
445
=======================
446
+
431
447
Automatic encryption can be configured on a ``Mongo::Client`` using the
432
448
``auto_encryption_options`` option ``Hash``. This section provides an overview
433
449
of the fields inside ``auto_encryption_options`` and explains how to choose their
434
450
values.
435
451
436
452
``:key_vault_client``
437
453
~~~~~~~~~~~~~~~~~~~~~
454
+
438
455
The key vault client is a ``Mongo::Client`` instance that will be used to connect
439
456
to the MongoDB collection containing your encryption data keys. For example, if
440
457
your key vault was hosted on a MongoDB instance at ``localhost:30000``:
@@ -456,6 +473,7 @@ to insert and fetch data keys.
456
473
457
474
``:key_vault_namespace``
458
475
~~~~~~~~~~~~~~~~~~~~~~~~
476
+
459
477
The key vault namespace is a ``String`` in the format ``"database_name.collection_name"``,
460
478
where ``database_name`` and ``collection_name`` are the name of the database and
461
479
collection in which you would like to store your data keys. For example, if your data
@@ -474,6 +492,7 @@ There is no default key vault namespace, and this option must be provided.
474
492
475
493
``:schema_map``
476
494
~~~~~~~~~~~~~~~
495
+
477
496
A schema map is a Hash with information about which fields to automatically
478
497
encrypt and decrypt.
479
498
@@ -549,11 +568,12 @@ When you intend to use your schema map, convert it to a Ruby ``Hash`` using the
549
568
550
569
.. seealso::
551
570
552
- :drivers: `Specify Encrypted Fields Using JSON Schema</security/client-side-field-level-encryption-guide/ #c-specify-encrypted-fields-using-json-schema>`,
571
+ `Specify Encrypted Fields Using JSON Schema <https://www.mongodb.com/docs/manual/core/csfle/ #c-specify-encrypted-fields-using-json-schema>`_ ,
553
572
:manual:`Automatic Encryption Rules</reference/security-client-side-automatic-json-schema/>`
554
573
555
574
``:bypass_auto_encryption``
556
575
~~~~~~~~~~~~~~~~~~~~~~~~~~~
576
+
557
577
The ``:bypass_auto_encryption`` option is a ``Boolean`` that specifies whether the
558
578
``Mongo::Client`` should skip encryption when writing to the database. If
559
579
``:bypass_auto_encryption`` is ``true``, the client will still perform automatic
@@ -568,8 +588,11 @@ decryption of any previously-encrypted data.
568
588
}
569
589
)
570
590
591
+ .. _cse-extra-options:
592
+
571
593
``:extra_options``
572
594
~~~~~~~~~~~~~~~~~~
595
+
573
596
``:extra_options`` is a ``Hash`` of options related to spawning mongocryptd.
574
597
Every option in this ``Hash`` has a default value, so it is only necessary to
575
598
provide the options whose defaults you want to override.
0 commit comments