MongoDB\Driver\Manager::createClientEncryption

(mongodb >=1.7.0)

MongoDB\Driver\Manager::createClientEncryptionCreate a new ClientEncryption object

説明

final public MongoDB\Driver\Manager::createClientEncryption(array $options): MongoDB\Driver\ClientEncryption

Constructs a new MongoDB\Driver\ClientEncryption object with the specified options.

パラメータ

options

options
Option Type Description
keyVaultClient MongoDB\Driver\Manager The Manager used to route data key queries to a separate MongoDB cluster. By default, the current Manager and cluster is used.
keyVaultNamespace string A fully qualified namespace (e.g. "databaseName.collectionName") denoting the collection that contains all data keys used for encryption and decryption.
kmsProviders array

A document containing the configuration for one or more KMS providers, which are used to encrypt data keys. Currently "aws", "azure", "gcp", and "local" are supported and at least one must be specified.

The format for "aws" is as follows:

aws: {
    accessKeyId: <string>,
    secretAccessKey: <string>
}

The format for "azure" is as follows:

azure: {
    tenantId: <string>,
    clientId: <string>,
    clientSecret: <string>,
    identityPlatformEndpoint: <optional string> // Defaults to "login.microsoftonline.com"

}

The format for "gcp" is as follows:

aws: {
    email: <string>,
    privateKey: <base64 string>|<MongoDB\BSON\Binary>,
    endpoint: <optional string> // Defaults to "oauth2.googleapis.com"

}

The format for "local" is as follows:

local: {
    // 96-byte master key used to encrypt/decrypt data keys
    key: <base64 string>|<MongoDB\BSON\Binary>
}
tlsOptions array

A document containing the TLS configuration for one or more KMS providers. Supported providers include "aws", "azure", "gcp", and "kmip". All providers support the following options:

<provider>: {
    tlsCaFile: <optional string>,
    tlsCertificateKeyFile: <optional string>,
    tlsCertificateKeyFilePassword: <optional string>
}

戻り値

Returns a new MongoDB\Driver\ClientEncryption instance.

エラー / 例外

変更履歴

バージョン 説明
PECL mongodb 1.12.0

KMIP is now supported as a KMS provider for client-side encryption and may be configured in the "kmsProviders" option.

Added the "tlsOptions" option.

PECL mongodb 1.10.0 Azure and GCP are now supported as KMS providers for client-side encryption and may be configured in the "kmsProviders" option. Base64-encoded strings are now accepted as an alternative to MongoDB\BSON\Binary for options within "kmsProviders".

参考

関連キーワード:  Driver, ClientEncryption, new, Manager, providers, optional, kmsProviders, KMS, data, format