Skip to content

Commit b3beada

Browse files
kevinAlbskevinAlbs
authored
SPEC-1774 support AWS temp creds in CSFLE (#900)
1 parent ee0c23b commit b3beada

File tree

5 files changed

+408
-3
lines changed

5 files changed

+408
-3
lines changed

‎source/client-side-encryption/client-side-encryption.rst

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -364,7 +364,8 @@ to authenticate.
364364
365365
aws: {
366366
accessKeyId: String,
367-
secretAccessKey: String
367+
secretAccessKey: String,
368+
sessionToken: Optional<String> // Required for temporary AWS credentials.
368369
}
369370
370371
azure: {
@@ -1512,6 +1513,7 @@ Changelog
15121513
=========
15131514
15141515
+------------+------------------------------------------------------------+
1516+
| 2021-01-22 | Add sessionToken option to 'aws' KMS provider |
15151517
| 2020-12-12 | Add metadataClient option and internal client |
15161518
| 2020-10-19 | Add 'azure' and 'gcp' KMS providers |
15171519
| 2019-10-11 | Add 'endpoint' to AWS masterkey |

‎source/client-side-encryption/etc/test-templates/awsTemporary.yml.template

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
runOn:
2+
- minServerVersion: "4.1.10"
3+
database_name: &database_name "default"
4+
collection_name: &collection_name "default"
5+
6+
data: []
7+
json_schema: {{schema()}}
8+
key_vault_data: [{{key()}}]
9+
10+
tests:
11+
- description: "Insert a document with auto encryption using the AWS provider with temporary credentials"
12+
clientOptions:
13+
autoEncryptOpts:
14+
kmsProviders:
15+
awsTemporary: {}
16+
operations:
17+
- name: insertOne
18+
arguments:
19+
document: &doc0 { _id: 1, encrypted_string: "string0" }
20+
expectations:
21+
# Auto encryption will request the collection info.
22+
- command_started_event:
23+
command:
24+
listCollections: 1
25+
filter:
26+
name: *collection_name
27+
command_name: listCollections
28+
# Then key is fetched from the key vault.
29+
- command_started_event:
30+
command:
31+
find: datakeys
32+
filter: { $or: [ { _id: { $in: [ {{key()["_id"]}} ] } }, { keyAltNames: { $in: [] } } ] }
33+
$db: keyvault
34+
command_name: find
35+
- command_started_event:
36+
command:
37+
insert: *collection_name
38+
documents:
39+
- &doc0_encrypted { _id: 1, encrypted_string: {{ciphertext("string0", field="encrypted_string")}} }
40+
ordered: true
41+
command_name: insert
42+
outcome:
43+
collection:
44+
# Outcome is checked using a separate MongoClient without auto encryption.
45+
data:
46+
- *doc0_encrypted
47+
- description: "Insert with invalid temporary credentials"
48+
clientOptions:
49+
autoEncryptOpts:
50+
kmsProviders:
51+
awsTemporaryNoSessionToken: {}
52+
operations:
53+
- name: insertOne
54+
arguments:
55+
document: *doc0
56+
result:
57+
errorContains: "security token"

‎source/client-side-encryption/tests/README.rst

Lines changed: 66 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,72 @@ Then for each element in ``tests``:
147147

148148
#. Create a **new** MongoClient using ``clientOptions``.
149149

150-
#. If ``autoEncryptOpts`` includes ``aws``, ``azure``, and/or ``gcp`` as a KMS provider, pass in credentials from the environment.
151-
#. If ``autoEncryptOpts`` does not include ``keyVaultNamespace``, default it to ``keyvault.datakeys``.
150+
#. If ``autoEncryptOpts`` includes ``aws``, ``awsTemporary``, ``awsTemporaryNoSessionToken``,
151+
``azure``, and/or ``gcp`` as a KMS provider, pass in credentials from the environment.
152+
153+
- ``awsTemporary``, and ``awsTemporaryNoSessionToken`` require temporary
154+
AWS credentials. These can be retrieved using the csfle `set-temp-creds.sh
155+
<https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/csfle>`_
156+
script.
157+
158+
- ``aws``, ``awsTemporary``, and ``awsTemporaryNoSessionToken`` are
159+
mutually exclusive.
160+
161+
``aws`` should be substituted with:
162+
163+
.. code:: javascript
164+
165+
"aws": {
166+
"accessKeyId": <set from environment>,
167+
"secretAccessKey": <set from environment>
168+
}
169+
170+
``awsTemporary`` should be substituted with:
171+
172+
.. code:: javascript
173+
174+
"aws": {
175+
"accessKeyId": <set from environment>,
176+
"secretAccessKey": <set from environment>
177+
"sessionToken": <set from environment>
178+
}
179+
180+
``awsTemporaryNoSessionToken`` should be substituted with:
181+
182+
.. code:: javascript
183+
184+
"aws": {
185+
"accessKeyId": <set from environment>,
186+
"secretAccessKey": <set from environment>
187+
}
188+
189+
``gcp`` should be substituted with:
190+
191+
.. code:: javascript
192+
193+
"gcp": {
194+
"email": <set from environment>,
195+
"privateKey": <set from environment>,
196+
}
197+
198+
``azure`` should be substituted with:
199+
200+
.. code:: javascript
201+
202+
"azure": {
203+
"tenantId": <set from environment>,
204+
"clientId": <set from environment>,
205+
"clientSecret": <set from environment>,
206+
}
207+
208+
``local`` should be substituted with:
209+
210+
.. code:: javascript
211+
212+
"local": { "key": <base64 decoding of LOCAL_MASTERKEY> }
213+
214+
#. If ``autoEncryptOpts`` does not include ``keyVaultNamespace``, default it
215+
to ``keyvault.datakeys``.
152216

153217
#. For each element in ``operations``:
154218

‎source/client-side-encryption/tests/awsTemporary.json

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
{
2+
"runOn": [
3+
{
4+
"minServerVersion": "4.1.10"
5+
}
6+
],
7+
"database_name": "default",
8+
"collection_name": "default",
9+
"data": [],
10+
"json_schema": {
11+
"properties": {
12+
"encrypted_w_altname": {
13+
"encrypt": {
14+
"keyId": "/altname",
15+
"bsonType": "string",
16+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
17+
}
18+
},
19+
"encrypted_string": {
20+
"encrypt": {
21+
"keyId": [
22+
{
23+
"$binary": {
24+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
25+
"subType": "04"
26+
}
27+
}
28+
],
29+
"bsonType": "string",
30+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
31+
}
32+
},
33+
"random": {
34+
"encrypt": {
35+
"keyId": [
36+
{
37+
"$binary": {
38+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
39+
"subType": "04"
40+
}
41+
}
42+
],
43+
"bsonType": "string",
44+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
45+
}
46+
},
47+
"encrypted_string_equivalent": {
48+
"encrypt": {
49+
"keyId": [
50+
{
51+
"$binary": {
52+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
53+
"subType": "04"
54+
}
55+
}
56+
],
57+
"bsonType": "string",
58+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
59+
}
60+
}
61+
},
62+
"bsonType": "object"
63+
},
64+
"key_vault_data": [
65+
{
66+
"status": 1,
67+
"_id": {
68+
"$binary": {
69+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
70+
"subType": "04"
71+
}
72+
},
73+
"masterKey": {
74+
"provider": "aws",
75+
"key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
76+
"region": "us-east-1"
77+
},
78+
"updateDate": {
79+
"$date": {
80+
"$numberLong": "1552949630483"
81+
}
82+
},
83+
"keyMaterial": {
84+
"$binary": {
85+
"base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO",
86+
"subType": "00"
87+
}
88+
},
89+
"creationDate": {
90+
"$date": {
91+
"$numberLong": "1552949630483"
92+
}
93+
},
94+
"keyAltNames": [
95+
"altname",
96+
"another_altname"
97+
]
98+
}
99+
],
100+
"tests": [
101+
{
102+
"description": "Insert a document with auto encryption using the AWS provider with temporary credentials",
103+
"clientOptions": {
104+
"autoEncryptOpts": {
105+
"kmsProviders": {
106+
"awsTemporary": {}
107+
}
108+
}
109+
},
110+
"operations": [
111+
{
112+
"name": "insertOne",
113+
"arguments": {
114+
"document": {
115+
"_id": 1,
116+
"encrypted_string": "string0"
117+
}
118+
}
119+
}
120+
],
121+
"expectations": [
122+
{
123+
"command_started_event": {
124+
"command": {
125+
"listCollections": 1,
126+
"filter": {
127+
"name": "default"
128+
}
129+
},
130+
"command_name": "listCollections"
131+
}
132+
},
133+
{
134+
"command_started_event": {
135+
"command": {
136+
"find": "datakeys",
137+
"filter": {
138+
"$or": [
139+
{
140+
"_id": {
141+
"$in": [
142+
{
143+
"$binary": {
144+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
145+
"subType": "04"
146+
}
147+
}
148+
]
149+
}
150+
},
151+
{
152+
"keyAltNames": {
153+
"$in": []
154+
}
155+
}
156+
]
157+
},
158+
"$db": "keyvault"
159+
},
160+
"command_name": "find"
161+
}
162+
},
163+
{
164+
"command_started_event": {
165+
"command": {
166+
"insert": "default",
167+
"documents": [
168+
{
169+
"_id": 1,
170+
"encrypted_string": {
171+
"$binary": {
172+
"base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
173+
"subType": "06"
174+
}
175+
}
176+
}
177+
],
178+
"ordered": true
179+
},
180+
"command_name": "insert"
181+
}
182+
}
183+
],
184+
"outcome": {
185+
"collection": {
186+
"data": [
187+
{
188+
"_id": 1,
189+
"encrypted_string": {
190+
"$binary": {
191+
"base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
192+
"subType": "06"
193+
}
194+
}
195+
}
196+
]
197+
}
198+
}
199+
},
200+
{
201+
"description": "Insert with invalid temporary credentials",
202+
"clientOptions": {
203+
"autoEncryptOpts": {
204+
"kmsProviders": {
205+
"awsTemporaryNoSessionToken": {}
206+
}
207+
}
208+
},
209+
"operations": [
210+
{
211+
"name": "insertOne",
212+
"arguments": {
213+
"document": {
214+
"_id": 1,
215+
"encrypted_string": "string0"
216+
}
217+
},
218+
"result": {
219+
"errorContains": "security token"
220+
}
221+
}
222+
]
223+
}
224+
]
225+
}

0 commit comments

Comments
 (0)