getKeyVault()（mongosh方法）

getKeyVault()

返回当前数据库连接的KeyVault对象。 KeyVault对象支持客户端字段级加密的数据加密密钥管理。

返回：	当前数据库连接的`KeyVault`对象。

兼容性

此命令可用于以下环境中托管的部署：

MongoDB Atlas：用于云中 MongoDB 部署的完全托管服务

MongoDB Enterprise：基于订阅、自我管理的 MongoDB 版本
MongoDB Community：源代码可用、免费使用且可自行管理的 MongoDB 版本

语法

getKeyVault() 通过以下语法实现：

keyVault = db.getMongo().getKeyVault();

使用KeyVault对象访问以下数据加密密钥管理方法：

行为

需要在数据库连接上配置客户端字段级加密

以下示例使用本地托管的密钥进行客户端字段级加密配置。

The mongosh client-side field level encryption methods require a database connection with client-side field level encryption enabled. If the current database connection was not initiated with client-side field level encryption enabled, either:

Use the Mongo() constructor from the mongosh to establish a connection with the required client-side field level encryption options. The Mongo() method supports the following Key Management Service (KMS) providers for Customer Master Key (CMK) management:
or
Use the mongosh command line options to establish a connection with the required options. The command line options only support the Amazon Web Services KMS provider for CMK management.

Key Vault 上的唯一部分索引

The getKeyVault() method automatically creates a unique index on the keyAltNames field with a partial index filter for only documents where keyAltNames exists. getKeyVault() creates this index in the key vault collection. This prevents any two data encryption keys in the same key vault from having the same key alternative name and therefore avoids ambiguity around which data encryption key is appropriate for encryption/decryption.

警告

Do not drop the unique index created by getKeyVault(). Client-Side Field Level Encryption operations depend on server-enforced uniqueness of keyAltNames. Removing the index may lead to unexpected or unpredictable behavior.

例子

以下示例使用本地托管的密钥进行客户端字段级加密配置。

启动 mongosh

启动mongosh客户端。

mongosh --nodb

生成密钥

要为本地托管的密钥配置客户端字段级加密，请生成一个不带换行符的 base64 编码的 96 字节字符串。

const TEST_LOCAL_KEY = require("crypto").randomBytes(96).toString("base64")

创建客户端字段级加密选项

使用生成的本地密钥字符串创建客户端字段级加密选项：

 let autoEncryptionOpts = {
   "keyVaultNamespace" : "encryption.__dataKeys",
   "kmsProviders" : {
     "local" : {
       "key" : BinData(0, TEST_LOCAL_KEY)
     }
   }
 }

创建加密客户端

使用配置了客户端字段级加密选项的Mongo()构造函数来创建数据库连接。将mongodb://myMongo.example.net URI 替换为目标集群的连接字符串 URI 。

encryptedClient = Mongo(
  "mongodb://myMongo.example.net:27017/?replSetName=myMongo",
   autoEncryptionOpts
)

Use the getKeyVault() method to retrieve the key vault object:

keyVault = encryptedClient.getKeyVault()

有关在启用客户端字段级加密的情况下启动 MongoDB 连接的完整文档，请参阅Mongo() 。