Loading...

XML

Word

Printable

JSON

Quarter:
- FY23Q3
Story Points:
5
Case:
Upstream Changes Summary:
Hide

~~DRIVERS-2280~~:

Call mongocrypt_setopt_use_need_kms_credentials_state to opt in to handling the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state.

Handle the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state. If the originally configured KMS providers have an empty aws: {}, attempt to obtain AWS credentials following the logic of Obtaining Credentials (excluding the URI section). Pass the new credentials back with mongocrypt_ctx_provide_kms_providers.

A new CSFLE prose test is introduced in 5cf3ed7.

Please see the C driver implementation as a reference. Note: the C driver also supports a user-provided callback for KMS providers. That is not in scope of ~~DRIVERS-2280~~.
Show
DRIVERS-2280 : Call mongocrypt_setopt_use_need_kms_credentials_state to opt in to handling the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state. Handle the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state. If the originally configured KMS providers have an empty aws: { }, attempt to obtain AWS credentials following the logic of Obtaining Credentials (excluding the URI section). Pass the new credentials back with mongocrypt_ctx_provide_kms_providers . A new CSFLE prose test is introduced in 5cf3ed7 . Please see the C driver implementation as a reference . Note: the C driver also supports a user-provided callback for KMS providers. That is not in scope of DRIVERS-2280 .
Compass/DevTools Changes:
Not Needed

This ticket was split from DRIVERS-2280, please see that ticket for a detailed description.

Call mongocrypt_setopt_use_need_kms_credentials_state to opt in to handling the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state. This is already implemented in the libmongocrypt Node bindings.
Handle the new MONGOCRYPT_CTX_NEED_KMS_CREDENTIALS state. (The Node state machine already has this case) If the originally configured KMS providers have an empty aws: {}, attempt to obtain AWS credentials following the logic of Obtaining Credentials (excluding the URI section) if the existing user provided callback doesn't fill them out. Pass the new credentials back with mongocrypt_ctx_provide_kms_providers
Write integration tests in the driver that test that the AWS credentials can be found and used.

Please see the C driver implementation as a reference. Note: the C driver also supports a user-provided callback for KMS providers. That is not in scope of ~~DRIVERS-2280~~.

split from

DRIVERS-2280 Obtain AWS credentials for CSFLE in the same way as for MONGODB-AWS

1.	Allow CSFLE Bindings To Accept AWS Env Callback	NODE-4604		Closed	Durran Jordan
2.	Use AWS-SDK as credential provider if present	NODE-4721		Closed	Durran Jordan	4.11.0