encryption – Client-Side Field Level Encryption

    class pymongo.encryption.Algorithm

    An enum that defines the supported encryption algorithms.

    class pymongo.encryption.ClientEncryption(kms_providers, key_vault_namespace, key_vault_client, codec_options)

    Explicit client-side field level encryption.

    The ClientEncryption class encapsulates explicit operations on a key vault collection that cannot be done directly on a MongoClient. Similar to configuring auto encryption on a MongoClient, it is constructed with a MongoClient (to a MongoDB cluster containing the key vault collection), KMS provider configuration, and keyVaultNamespace. It provides an API for explicitly encrypting and decrypting values, and creating data keys. It does not provide an API to query keys from the key vault collection, as this can be done directly on the MongoClient.

    See Explicit Encryption for an example.

    • Parameters

      • kms_providers: Map of KMS provider options. Two KMS providers are supported: “aws” and “local”. The kmsProviders map values differ by provider:

      • key_vault_namespace: The namespace for the key vault collection. The key vault collection contains all data keys used for encryption and decryption. Data keys are stored as documents in this MongoDB collection. Data keys are protected with encryption by a KMS provider.

    New in version 3.9.

    • close()

      Release resources.

      Note that using this class in a with-statement will automatically call :

    • create_data_key(kms_provider, master_key=None, key_alt_names=None)

      Create and insert a new data key into the key vault collection.

      • Parameters

        • kms_provider: The KMS provider to use. Supported values are “aws” and “local”.

        • master_key: Identifies a KMS-specific key used to encrypt the new data key. If the kmsProvider is “local” the master_key is not applicable and may be omitted.

          If the kms_provider is “aws” it is required and has the following fields:

          If the kms_provider is “azure” it is required and has the following fields:

          If the kms_provider is “gcp” it is required and has the following fields:

        • key_alt_names (optional): An optional list of string alternate names used to reference a key. If a key is created with alternate names, then encryption may refer to the key by the unique alternate name instead of by . The following example shows creating and referring to a data key by alternate name:

        Returns

    • encrypt(value, algorithm, key_id=None, key_alt_name=None)

      Encrypt a BSON value with a given key and algorithm.

      Note that exactly one of or key_alt_name must be provided.

      • Parameters

        • value: The BSON value to encrypt.

        • algorithm (string): The encryption algorithm to use. See Algorithm for some valid options.

        • key_id: Identifies a data key by which must be a with subtype 4 ( UUID_SUBTYPE).

        Returns