mongocxx::options::client_encryption Class Reference

#include <mongocxx/v_noabi/mongocxx/options/client_encryption.hpp>

Description

Used by mongocxx::v_noabi::client_encryption.

Public Types
using	ns_pair = std::pair<std::string, std::string>
	Represents the name of a database and a collection.

Public Member Functions
	client_encryption ()=default
	Default initialization.
bsoncxx::v_noabi::stdx::optional< v_noabi::client * > const &	key_vault_client () const
	Gets the key vault client.
client_encryption &	key_vault_client (v_noabi::client *client)
	When the key vault collection is on a separate MongoDB cluster, sets the optional client to use to route data key queries to that cluster.
bsoncxx::v_noabi::stdx::optional< ns_pair > const &	key_vault_namespace () const
	Gets the key vault namespace.
client_encryption &	key_vault_namespace (ns_pair ns)
	Sets the namespace to use to access the key vault collection, which contains all data keys used for encryption and decryption. This option must be set:
bsoncxx::v_noabi::stdx::optional< bsoncxx::v_noabi::document::view_or_value > const &	kms_providers () const
	Gets the KMS providers.
client_encryption &	kms_providers (bsoncxx::v_noabi::document::view_or_value kms_providers)
	Sets the KMS providers to use for client side encryption.
bsoncxx::v_noabi::stdx::optional< bsoncxx::v_noabi::document::view_or_value > const &	tls_opts () const
	Gets the TLS options.
client_encryption &	tls_opts (bsoncxx::v_noabi::document::view_or_value tls_opts)
	Sets the TLS options to use for client side encryption with a given KMS provider.

Member Typedef Documentation

ns_pair

using mongocxx::v_noabi::options::client_encryption::ns_pair = std::pair<std::string, std::string>

Represents the name of a database and a collection.

Constructor & Destructor Documentation

client_encryption()

mongocxx::v_noabi::options::client_encryption::client_encryption ( )

default

Default initialization.

Member Function Documentation

key_vault_client() [1/2]

bsoncxx::v_noabi::stdx::optional< v_noabi::client * > const & mongocxx::v_noabi::options::client_encryption::key_vault_client ( ) const

inline

Gets the key vault client.

Returns

An optional pointer to the key vault client.

key_vault_client() [2/2]

client_encryption & mongocxx::v_noabi::options::client_encryption::key_vault_client ( v_noabi::client * client )

inline

When the key vault collection is on a separate MongoDB cluster, sets the optional client to use to route data key queries to that cluster.

Parameters

client

A client to use for routing queries to the key vault collection.

Returns

A reference to this object to facilitate method chaining.

See also

• https://www.mongodb.com/docs/manual/core/security-client-side-encryption/

key_vault_namespace() [1/2]

bsoncxx::v_noabi::stdx::optional< ns_pair > const & mongocxx::v_noabi::options::client_encryption::key_vault_namespace ( ) const

inline

Gets the key vault namespace.

Returns

An optional pair of strings representing the namespace of the key vault collection.

key_vault_namespace() [2/2]

client_encryption & mongocxx::v_noabi::options::client_encryption::key_vault_namespace ( ns_pair ns )

inline

Sets the namespace to use to access the key vault collection, which contains all data keys used for encryption and decryption. This option must be set:

client_encryption.key_vault_namespace({ "db", "coll" });

Parameters

ns	A std::pair of strings representing the db and collection to use to access the key vault.

Returns

A reference to this object to facilitate method chaining.

See also

• https://www.mongodb.com/docs/manual/core/security-client-side-encryption/

kms_providers() [1/2]

bsoncxx::v_noabi::stdx::optional< bsoncxx::v_noabi::document::view_or_value > const & mongocxx::v_noabi::options::client_encryption::kms_providers ( ) const

inline

Gets the KMS providers.

Returns

An optional document containing the KMS providers.

kms_providers() [2/2]

client_encryption & mongocxx::v_noabi::options::client_encryption::kms_providers ( bsoncxx::v_noabi::document::view_or_value kms_providers )

inline

Sets the KMS providers to use for client side encryption.

Multiple KMS providers may be specified. KMS providers are specified as a string of the form <KMS-provider-type> or <KMS-provider-type>:<KMS-provider-name>. The supported KMS provider types are aws, azure, gcp, local, and kmip. The optional name enables configuring multiple KMS providers with the same KMS provider type (e.g. aws:name1 and aws:name2 can refer to different AWS accounts). At least one KMS provider must be specified.

Supported forms of the KMS provider type aws include:

aws: {
   accessKeyId: String,
   secretAccessKey: String
}
 
// To pass temporary credentials:
aws: {
   accessKeyId: String,
   secretAccessKey: String,
   sessionToken: String
}
 
// To request credentials from the environment:
aws: {}

Supported forms of the KMS provider type local include:

local: {
   // key is used to encrypt/decrypt data keys:
   key: "<96 byte BSON binary of subtype 0>" or String // May be passed as a base64 encoded string.
}

Supported forms of the KMS provider type azure include:

azure: {
   tenantId: String,
   clientId: String,
   clientSecret: String,
   identityPlatformEndpoint: Optional<String> // Defaults to login.microsoftonline.com
}
 
// To pass an accessToken directly:
azure: {
   accessToken: String
}
 
// To request credentials from the environment:
azure: {}

Supported forms of the KMS provider type gcp include:

gcp: {
   email: String,
   privateKey: byte[] or String, // May be passed as a base64 encoded string.
   endpoint: Optional<String> // Defaults to oauth2.googleapis.com
}
 
// To pass an accessToken directly:
gcp: {
   accessToken: String
}
 
// To request credentials from the environment:
gcp: {}

Supported forms of the KMS provider type kmip include:

kmip: {
   endpoint: String
}

KMS providers may include an optional name suffix separated with a colon. This enables configuring multiple KMS providers with the same KMS provider type. Example:

"aws:name1": {
   accessKeyId: String,
   secretAccessKey: String
},
"aws:name2": {
   accessKeyId: String,
   secretAccessKey: String
}

Parameters

kms_providers

A document containing the KMS providers.

Returns

A reference to this object to facilitate method chaining.

See also

• https://www.mongodb.com/docs/manual/core/security-client-side-encryption/

tls_opts() [1/2]

bsoncxx::v_noabi::stdx::optional< bsoncxx::v_noabi::document::view_or_value > const & mongocxx::v_noabi::options::client_encryption::tls_opts ( ) const

inline

Gets the TLS options.

Returns

An optional document containing the TLS options.

tls_opts() [2/2]

client_encryption & mongocxx::v_noabi::options::client_encryption::tls_opts ( bsoncxx::v_noabi::document::view_or_value tls_opts )

inline

Sets the TLS options to use for client side encryption with a given KMS provider.

Multiple KMS providers may be specified. Supported KMS providers are "aws", "azure", "gcp", and "kmip". The map value has the same form for all supported providers:

<KMS provider name>: {
    tlsCaFile: Optional<String>
    tlsCertificateKeyFile: Optional<String>
    tlsCertificateKeyFilePassword: Optional<String>
}

Parameters

tls_opts

A document containing the TLS options.

Returns

A reference to this object to facilitate method chaining.

See also

• https://www.mongodb.com/docs/manual/core/security-client-side-encryption/

---

The documentation for this class was generated from the following file:

• mongocxx/v_noabi/mongocxx/options/client_encryption.hpp