1runOn:
2 - minServerVersion: "4.1.10"
3database_name: &database_name "default"
4collection_name: &collection_name "default"
5
6data: []
7json_schema: {'properties': {'encrypted_w_altname': {'encrypt': {'keyId': '/altname', 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'random': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string_equivalent': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
8key_vault_data: [{'status': 1, '_id': {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}, 'masterKey': {'provider': 'aws', 'key': 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0', 'region': 'us-east-1'}, 'updateDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyMaterial': {'$binary': {'base64': 'AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO', 'subType': '00'}}, 'creationDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyAltNames': ['altname', 'another_altname']}]
9
10tests:
11 - description: "Insert with encryption using key alt name"
12 clientOptions:
13 autoEncryptOpts:
14 kmsProviders:
15 aws: {} # Credentials filled in from environment.
16 operations:
17 - name: insertOne
18 arguments:
19 document: &doc0 { _id: 1, encrypted_w_altname: "string0", altname: "altname" }
20 expectations:
21 # Auto encryption will request the collection info.
22 - command_started_event:
23 command:
24 listCollections: 1
25 filter:
26 name: *collection_name
27 command_name: listCollections
28 # Then key is fetched from the key vault.
29 - command_started_event:
30 command:
31 find: datakeys
32 filter: {$or: [ { _id: { $in: [] } }, { keyAltNames: { $in: [ "altname" ] } } ] }
33 $db: keyvault
34 readConcern: { level: "majority" }
35 command_name: find
36 - command_started_event:
37 command:
38 insert: *collection_name
39 documents:
40 - &doc0_encrypted { _id: 1, encrypted_w_altname: { $$type: "binData" }, altname: "altname" }
41 ordered: true
42 command_name: insert
43 outcome:
44 collection:
45 # Outcome is checked using a separate MongoClient without auto encryption.
46 data:
47 - *doc0_encrypted
48 - description: "Replace with key alt name fails"
49 clientOptions:
50 autoEncryptOpts:
51 kmsProviders:
52 aws: {} # Credentials filled in from environment.
53 operations:
54 - name: updateOne
55 arguments:
56 filter: {}
57 update: { $set: { encrypted_w_altname: "string0" } }
58 upsert: true
59 result:
60 errorContains: "A non-static (JSONPointer) keyId is not supported"
61 outcome:
62 collection:
63 # Outcome is checked using a separate MongoClient without auto encryption.
64 data: []View as plain text