クライアント側の暗号化

gem install libmongocrypt-helper --pre

export LIBMONGOCRYPT_PATH=/path/to/your/libmongocrypt.so

local_master_key = SecureRandom.random_bytes(96)
# => "\xB2\xBE\x8EN\xD4\x14\xC2\x13\xC3..." (a binary blob)

# A Mongo::Client instance that will be used to connect to the key vault
# collection. Replace the server address with the address of the MongoDB
# server where you would like to store your key vault collection.
key_vault_client = Mongo::Client.new(['localhost:27017'])
client_encryption = Mongo::ClientEncryption.new(
  key_vault_client,
  # Replace with the database and collection names for your key vault collection
  key_vault_namespace: 'encryption.__keyVault',
  kms_providers: {
    local: {
      key: local_master_key
    }
  }
)
data_key_id = client_encryption.create_data_key('local')
# => <BSON::Binary... type=ciphertext...>

# A Mongo::Client instance that will be used to connect to the key vault
# collection. Replace the server address with the address of the MongoDB
# server where you would like to store your key vault collection.
key_vault_client = Mongo::Client.new(['localhost:27017'])
client_encryption = Mongo::ClientEncryption.new(
  key_vault_client,
  # Replace with the database and collection names for your key vault collection
  key_vault_namespace: 'encryption.__keyVault',
  kms_providers: {
    aws: {
      access_key_id: 'IAM-ACCESS-KEY-ID',
      secret_access_key: 'IAM-SECRET-ACCESS-KEY'
    },
    azure: {
      tenant_id: 'AZURE-TENANT-ID',
      client_id: 'AZURE-CLIENT-ID',
      client_secret: 'AZURE-CLIENT-SECRET'
    },
    gcp: {
      email: 'GCP-EMAIL',
      # :private_key value should be GCP private key as base64 encoded
      # DER RSA private key, or PEM RSA private key, if you are using MRI Ruby.
      private_key: 'GCP-PRIVATE-KEY',
    },
    kmip: {
      # KMIP server endpoint may include port.
      endpoint: 'KMIP-SERVER-HOST'
    },
    # TLS options to connect to KMIP server.
    kms_tls_options: {
      kmip: {
        ssl_ca_cert: 'PATH-TO-CA-FILE',
        ssl_cert: 'PATH-TO-CLIENT-CERT-FILE',
        ssl_key: 'PATH-TO-CLIENT-KEY-FILE'
      }
    }
  }
)
aws_data_key_id = client_encryption.create_data_key(
  'aws',
  {
    master_key: {
      region: 'REGION-OF-YOUR-MASTER-KEY',
      key: 'ARN-OF-YOUR-MASTER-KEY'
    }
  }
)
# => <BSON::Binary... type=ciphertext...>
azure_data_key_id = client_encryption.create_data_key(
  'azure',
  {
    master_key: {
      key_vault_endpoint: 'AZURE-KEY-VAULT-ENDPOINT',
      key_name: 'AZURE-KEY-NAME'
    }
  }
)
# => <BSON::Binary... type=ciphertext...>
gcp_data_key_id = client_encryption.create_data_key(
  'gcp',
  {
    master_key: {
      project_id: 'GCP-PROJECT-ID',
      location: 'GCP-LOCATION',
      key_ring: 'GCP-KEY-RING',
      key_name: 'GCP-KEY-NAME',
    }
  }
)
# => <BSON::Binary... type=ciphertext...>

key_vault_client = Mongo::Client.new(['localhost:30000'])
Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    key_vault_client: key_vault_client,
    # ... (Fill in other options here)
  }
)

Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    key_vault_namespace: 'encryption.__keyVault',
    # ... (Fill in other options here)
  }
)

Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    key_vault_namespace: 'encryption.__keyVault',
    kms_providers: {
      aws: {
        access_key_id: 'IAM-ACCESS-KEY-ID',
        secret_access_key: 'IAM-SECRET-ACCESS-KEY'
      },
      azure: {
        tenant_id: 'AZURE-TENANT-ID',
        client_id: 'AZURE-CLIENT-ID',
        client_secret: 'AZURE-CLIENT-SECRET'
      },
      gcp: {
        email: 'GCP-EMAIL',
        # :private_key value should be GCP private key as base64 encoded
        # DER RSA private key, or PEM RSA private key, if you are using MRI Ruby.
        private_key: 'GCP-PRIVATE-KEY',
      },
      kmip: {
        # KMIP server endpoint may include port.
        endpoint: 'KMIP-SERVER-HOST'
      },
      # TLS options to connect to KMIP server.
      kms_tls_options: {
        kmip: {
          ssl_ca_cert: 'PATH-TO-CA-FILE',
          ssl_cert: 'PATH-TO-CLIENT-CERT-FILE',
          ssl_key: 'PATH-TO-CLIENT-KEY-FILE'
        }
      }
    }
  }
)

Mongo::Client.new(['localhost:27017'],
   auto_encryption_options: {
    key_vault_namespace: 'encryption.__keyVault',
    kms_providers: {
      aws: {}
    }
  }
)

Mongo::Client.new(['localhost:27017'],
   auto_encryption_options: {
    key_vault_namespace: 'encryption.__keyVault',
    kms_providers: {
      gcp: {}
    }
  }
)

Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    key_vault_namespace: 'encryption.__keyVault',
    kms_providers: {
      kmip: {
        endpoint: 'KMIP-SERVER-HOST'
      }
    },
    kms_tls_options: {
      kmip: {
        ssl_ca_cert: 'PATH-TO-CA-FILE',
        ssl_cert: 'PATH-TO-CLIENT-CERT-FILE',
        ssl_key: 'PATH-TO-CLIENT-KEY-FILE'
      }
    }
  }
)

Base64.encode64(data_key_id.data)
# => "sr6OTtQUwhPD..." (a base64-encoded string)

{
  "encryption_db.encryption_coll": {
    "properties": {
      "encrypted_field": {
        "encrypt": {
          "keyId": [{
            "$binary": {
              "base64": "YOUR-BASE64-ENCODED-DATA-KEY-ID",
              "subType": "04"
            }
          }],
          "bsonType": "string",
          "algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
        }
      }
    },
    "bsonType": "object"
  }
}

schema_map = BSON::ExtJSON.parse(File.read('/path/to/your/file.json'))
# => { 'encryption_db.encryption_coll' => { ... } }
Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    schema_map: schema_map,
    # ... (Fill in other options here)
  }
)

Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    schema_map_path: '/path/to/your/file.json',
    # ... (Fill in other options here)
  }
)

Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    bypass_auto_encryption: true,
    # ... (Fill in other options here)
  }
)

  Mongo::Client.new(['localhost:27017],
  auto_encryption_options: {
    extra_options: {
      mongocryptd_spawn_args: ['--port=30000'],
      mongocryptd_uri: 'mongodb://localhost:30000',
    }
    # ... (Fill in other options here)
  }
)