Integrate Azure Key Vault with MongoDB Client-Side Field Level Encryption

1
az keyvault key create --vault-name "YOUR-KEYVAULT-NAME" --name "YOUR-KEY-NAME" --protection software

1
using System;
2
using MongoDB.Driver;
3
4
namespace EnvoyMedSys
5
{
6
    public enum KmsKeyLocation
7
    {
8
        Azure,
9
    }
10
11
    class Program
12
    {
13
        public static void Main(string[] args)
14
        {
15
            var connectionString = Environment.GetEnvironmentVariable("MDB_ATLAS_URI");
16
            var keyVaultNamespace = CollectionNamespace.FromFullName("encryption.__keyVaultTemp");
17
18
            var kmsKeyHelper = new KmsKeyHelper(
19
                connectionString: connectionString,
20
                keyVaultNamespace: keyVaultNamespace);
21
            var autoEncryptHelper = new AutoEncryptHelper(
22
                connectionString: connectionString,
23
                keyVaultNamespace: keyVaultNamespace);
24
25
            var kmsKeyIdBase64 = kmsKeyHelper.CreateKeyWithAzureKmsProvider().GetAwaiter().GetResult();
26
27
            autoEncryptHelper.EncryptedWriteAndReadAsync(kmsKeyIdBase64, KmsKeyLocation.Azure).GetAwaiter().GetResult();
28
29
            Console.ReadKey();
30
        }
31
    }
32
}

1
public async Task<string> CreateKeyWithAzureKmsProvider()
2
{
3
    var kmsProviders = new Dictionary<string, IReadOnlyDictionary<string, object>>();
4
5
    // Pull Azure Key Vault settings from environment variables
6
    var azureTenantId = Environment.GetEnvironmentVariable("AZURE_TENANT_ID");
7
    var azureClientId = Environment.GetEnvironmentVariable("AZURE_CLIENT_ID");
8
    var azureClientSecret = Environment.GetEnvironmentVariable("AZURE_CLIENT_SECRET");
9
    var azureIdentityPlatformEndpoint = Environment.GetEnvironmentVariable("AZURE_IDENTIFY_PLATFORM_ENPDOINT"); // Optional, only needed if user is using a non-commercial Azure instance
10
11
   // Configure our registered application settings
12
   var azureKmsOptions = new Dictionary<string, object>
13
    {
14
        { "tenantId", azureTenantId },
15
        { "clientId", azureClientId },
16
        { "clientSecret", azureClientSecret },
17
    };
18
19
    if (azureIdentityPlatformEndpoint != null)
20
    {
21
        azureKmsOptions.Add("identityPlatformEndpoint", azureIdentityPlatformEndpoint);
22
    }
23
	
24
    // Specify remote key location; in this case, Azure
25
    kmsProviders.Add("azure", azureKmsOptions);
26
	
27
    // Constructs our client encryption settings which
28
    // specify which key vault client, key vault namespace,
29
    // and KMS providers to use. 
30
    var clientEncryption = GetClientEncryption(kmsProviders);
31
32
    // Set KMS Provider Settings
33
    // Client uses these settings to discover the master key
34
    var azureKeyName = Environment.GetEnvironmentVariable("AZURE_KEY_NAME");
35
    var azureKeyVaultEndpoint = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_ENDPOINT"); // typically <azureKeyName>.vault.azure.net
36
    var azureKeyVersion = Environment.GetEnvironmentVariable("AZURE_KEY_VERSION"); // Optional
37
    var dataKeyOptions = new DataKeyOptions(
38
        masterKey: new BsonDocument
39
        {
40
            { "keyName", azureKeyName },
41
            { "keyVaultEndpoint", azureKeyVaultEndpoint },
42
            { "keyVersion", () => azureKeyVersion, azureKeyVersion != null }
43
        });
44
	
45
    // Create Data Encryption Key
46
    var dataKeyId = clientEncryption.CreateDataKey("azure", dataKeyOptions, CancellationToken.None);
47
    Console.WriteLine($"Azure DataKeyId [UUID]: {dataKeyId}");
48
49
    var dataKeyIdBase64 = Convert.ToBase64String(GuidConverter.ToBytes(dataKeyId, GuidRepresentation.Standard));
50
    Console.WriteLine($"Azure DataKeyId [base64]: {dataKeyIdBase64}");
51
	
52
    // Optional validation; checks that key was created successfully
53
    await ValidateKeyAsync(dataKeyId);
54
55
    return dataKeyIdBase64;
56
}

1
private ClientEncryption GetClientEncryption(
2
	Dictionary<string, IReadOnlyDictionary<string, object>> kmsProviders)
3
{
4
    // Construct a MongoClient using our Atlas connection string
5
    var keyVaultClient = new MongoClient(_mdbConnectionString);
6
7
    // Set MongoClient, key vault namespace, and Azure as KMS provider
8
    var clientEncryptionOptions = new ClientEncryptionOptions(
9
    	keyVaultClient: keyVaultClient,
10
        keyVaultNamespace: _keyVaultNamespace,
11
        kmsProviders: kmsProviders);
12
13
    return new ClientEncryption(clientEncryptionOptions);
14
}

1
public async Task EncryptedWriteAndReadAsync(string keyIdBase64, KmsKeyLocation kmsKeyLocation)
2
{
3
    // Construct a JSON Schema
4
    var schema = JsonSchemaCreator.CreateJsonSchema(keyIdBase64);
5
6
    // Construct an auto-encrypting client
7
    var autoEncryptingClient = CreateAutoEncryptingClient(
8
        kmsKeyLocation,
9
        _keyVaultNamespace,
10
        schema);
11
12
    // Set our working database and collection to medicalRecords.patientData
13
    var collection = autoEncryptingClient
14
        .GetDatabase(_medicalRecordsNamespace.DatabaseNamespace.DatabaseName)
15
        .GetCollection<BsonDocument>(_medicalRecordsNamespace.CollectionName);
16
17
    var ssnQuery = Builders<BsonDocument>.Filter.Eq("ssn", __sampleSsnValue);
18
19
    // Upsert (update if found, otherwise create it) a document into the collection
20
    var medicalRecordUpdateResult = await collection
21
        .UpdateOneAsync(ssnQuery, new BsonDocument("$set", __sampleDocFields), new UpdateOptions() { IsUpsert = true });
22
23
    if (!medicalRecordUpdateResult.UpsertedId.IsBsonNull)
24
    {
25
        Console.WriteLine("Successfully upserted the sample document!");
26
    }
27
28
    // Query by SSN field with auto-encrypting client
29
    var result = await collection.Find(ssnQuery).SingleAsync();
30
	
31
    // Proper result in console should show decrypted, human-readable document
32
    Console.WriteLine($"Encrypted client query by the SSN (deterministically-encrypted) field:\n {result}\n");
33
}

1
{
2
    _id:UUID('ab382f3e-bc79-4086-8418-836a877efff3'),
3
keyMaterial:Binary('tvehP03XhUsztKr69lxlaGjiPhsNPjy6xLhNOLTpe4pYMeGjMIwvvZkzrwLRCHdaB3vqi9KKe6/P5xvjwlVHacQ1z9oFIwFbp9nk...', 0),
4
    creationDate:2021-08-24T05:01:34.369+00:00,
5
    updateDate:2021-08-24T05:01:34.369+00:00,
6
    status:0,
7
    masterKey:Object,
8
    provider:"azure",
9
    keyVaultEndpoint:"csfle-mdb-demo-vault.vault.azure.net",
10
    keyName:"MainKey"
11
}