[DRIVERS-2731] CSFLE/QE Support for more than 1 KMS provider per type Created: 22/Sep/23 Updated: 30/Jan/24 |
|
| Status: | Implementing |
| Project: | Drivers |
| Component/s: | Client Side Encryption |
| Fix Version/s: | None |
| Type: | Epic | Priority: | Major - P3 |
| Reporter: | Cynthia Braund (Inactive) | Assignee: | Kevin Albertson |
| Resolution: | Unresolved | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Driver Changes: | Needed | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Quarter: | FY24Q4 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Downstream Changes Summary: | SummaryDriver ChangesSome drivers may need API changes to accept an arbitrary string where a KMS provider is accepted: kmsProviders, KMSProvidersTLSOptions, ClientEncryption.createDataKey(), and RewrapManyDataKeyOpts.provider Can current drivers accept arbitrary strings for KMS identifier? suggests Node and Rust will need API changes. Drivers may need changes to support named KMS providers in the KMSProvidersTLSOptions map. Test ChangesSpecification tests are added. This introduces use of the encrypt and decrypt operations in the unified test format. The Unified Test Format schema 1.18 is added to allow patternProperties in kmsProviders. Tests refer to additional KMS providers: local:name1, aws:name1, gcp:name1, azure:name1, and kmip:name1. The name1 KMS providers may be configured exactly as the unnamed KMS providers. I.e. aws:name1 is configured the same as aws. To test configuring two KMS providers of the same type referring to distinct credentials, two more test KMS providers are defined: local:name2 and aws:name2. Test credentials for aws:name2 are available in AWS Secrets Manager under drivers/csfle. The aws:name2 account credentials are in FLE_AWS_SECRET2 and FLE_AWS_KEY2. See https://wiki.corp.mongodb.com/display/DRIVERS/Using+AWS+Secrets+Manager+to+Store+Testing+Secrets for more background on how the secrets are managed. Prose Test 11 (KMS TLS Options Tests) is extended to test named KMS providers. Referenceshttps://github.com/mongodb/specifications/pull/1492 includes the specification change and tests. https://github.com/mongodb/mongo-c-driver/pull/1509 is a reference implementation in the C driver. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Engineering Lead: | |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Program Manager: | |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Start date: | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Scope Cost Estimate: | 0 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Cost to Date: | 0 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Final Cost Estimate: | 0 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Cost Threshold %: | 100 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Detailed Project Statuses: | 2024-01-19: Status update:
2024-01-08: Status update:
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Driver Compliance: |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description |
| Comments |
| Comment by Githook User [ 30/Jan/24 ] |
|
Author: {'name': 'Kevin Albertson', 'email': 'kevin.albertson@mongodb.com', 'username': 'kevinAlbs'}Message: DRIVERS-2731 support named KMS providers (#1492)
To test automatic encryption for named KMS
AWS and local are not the only KMS providers supported. Remove sentence. Specifics of KMS providers are described in the `kmsProviders` section.
KMSProviderName was previously one of the strings "aws", "azure", "gcp", "local", or "kmip". The term "KMS provider" consists of the same set of strings, but also includes an optional name suffix. Use KMSProvider to match the term and avoid ambiguity with "KMS provider name".
Note that "aws" is a `KMS provider type`, not a `KMS provider`.
May help readers unfamiliar with typescript interfaces.
|
| Comment by Ashni Mehta [ 29/Jan/24 ] |
|
Prioritization note: Checked in with elizabeth.roytburd@mongodb.com – customers are asking but this is not critical re: .local. As per Kenn/Liz: would be nice to preannounce if we think this will coincide with GA. |