Skip to content

Commit 0a36ec8

Browse files
emadumemadum
authored
test(NODE-3063): support AWS temp credentials in CSFLE tests (#2880)
1 parent c001d07 commit 0a36ec8

File tree

6 files changed

+308
-0
lines changed

6 files changed

+308
-0
lines changed

‎.evergreen/config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,9 @@ functions:
109109
cat <<EOT > prepare_client_encryption.sh
110110
export CLIENT_ENCRYPTION=${CLIENT_ENCRYPTION}
111111
export CSFLE_KMS_PROVIDERS='${CSFLE_KMS_PROVIDERS}'
112+
export AWS_ACCESS_KEY_ID='${AWS_ACCESS_KEY_ID}'
113+
export AWS_SECRET_ACCESS_KEY='${AWS_SECRET_ACCESS_KEY}'
114+
export AWS_DEFAULT_REGION='us-east-1'
112115
EOT
113116
fi
114117
- command: shell.exec

‎.evergreen/config.yml.in‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,9 @@ functions:
129129
cat <<EOT > prepare_client_encryption.sh
130130
export CLIENT_ENCRYPTION=${CLIENT_ENCRYPTION}
131131
export CSFLE_KMS_PROVIDERS='${CSFLE_KMS_PROVIDERS}'
132+
export AWS_ACCESS_KEY_ID='${AWS_ACCESS_KEY_ID}'
133+
export AWS_SECRET_ACCESS_KEY='${AWS_SECRET_ACCESS_KEY}'
134+
export AWS_DEFAULT_REGION='us-east-1'
132135
EOT
133136
fi
134137
- command: shell.exec

‎.evergreen/run-tests.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@ if [[ -z "${CLIENT_ENCRYPTION}" ]]; then
4242
unset AWS_SECRET_ACCESS_KEY;
4343
else
4444
npm install mongodb-client-encryption@">=1.2.6"
45+
46+
# Get access to the AWS temporary credentials:
47+
echo "adding temporary AWS credentials to environment"
48+
# CSFLE_AWS_TEMP_ACCESS_KEY_ID, CSFLE_AWS_TEMP_SECRET_ACCESS_KEY, CSFLE_AWS_TEMP_SESSION_TOKEN
49+
. $DRIVERS_TOOLS/.evergreen/csfle/set-temp-creds.sh
4550
fi
4651

4752
MONGODB_API_VERSION=${MONGODB_API_VERSION} MONGODB_UNIFIED_TOPOLOGY=${UNIFIED} MONGODB_URI=${MONGODB_URI} npm run ${TEST_NPM_SCRIPT}

‎test/functional/spec-runner/index.js‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,21 @@ function translateClientOptions(options) {
5353
kmsProviders.local = options.autoEncryptOpts.kmsProviders.local;
5454
}
5555

56+
if (options.autoEncryptOpts.kmsProviders.awsTemporary) {
57+
kmsProviders.aws = {
58+
accessKeyId: process.env.CSFLE_AWS_TEMP_ACCESS_KEY_ID,
59+
secretAccessKey: process.env.CSFLE_AWS_TEMP_SECRET_ACCESS_KEY,
60+
sessionToken: process.env.CSFLE_AWS_TEMP_SESSION_TOKEN
61+
};
62+
}
63+
64+
if (options.autoEncryptOpts.kmsProviders.awsTemporaryNoSessionToken) {
65+
kmsProviders.aws = {
66+
accessKeyId: process.env.CSFLE_AWS_TEMP_ACCESS_KEY_ID,
67+
secretAccessKey: process.env.CSFLE_AWS_TEMP_SECRET_ACCESS_KEY
68+
};
69+
}
70+
5671
options.autoEncryption.kmsProviders = kmsProviders;
5772
}
5873

‎test/spec/client-side-encryption/tests/awsTemporary.json‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
{
2+
"runOn": [
3+
{
4+
"minServerVersion": "4.1.10"
5+
}
6+
],
7+
"database_name": "default",
8+
"collection_name": "default",
9+
"data": [],
10+
"json_schema": {
11+
"properties": {
12+
"encrypted_w_altname": {
13+
"encrypt": {
14+
"keyId": "/altname",
15+
"bsonType": "string",
16+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
17+
}
18+
},
19+
"encrypted_string": {
20+
"encrypt": {
21+
"keyId": [
22+
{
23+
"$binary": {
24+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
25+
"subType": "04"
26+
}
27+
}
28+
],
29+
"bsonType": "string",
30+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
31+
}
32+
},
33+
"random": {
34+
"encrypt": {
35+
"keyId": [
36+
{
37+
"$binary": {
38+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
39+
"subType": "04"
40+
}
41+
}
42+
],
43+
"bsonType": "string",
44+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
45+
}
46+
},
47+
"encrypted_string_equivalent": {
48+
"encrypt": {
49+
"keyId": [
50+
{
51+
"$binary": {
52+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
53+
"subType": "04"
54+
}
55+
}
56+
],
57+
"bsonType": "string",
58+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
59+
}
60+
}
61+
},
62+
"bsonType": "object"
63+
},
64+
"key_vault_data": [
65+
{
66+
"status": 1,
67+
"_id": {
68+
"$binary": {
69+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
70+
"subType": "04"
71+
}
72+
},
73+
"masterKey": {
74+
"provider": "aws",
75+
"key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
76+
"region": "us-east-1"
77+
},
78+
"updateDate": {
79+
"$date": {
80+
"$numberLong": "1552949630483"
81+
}
82+
},
83+
"keyMaterial": {
84+
"$binary": {
85+
"base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO",
86+
"subType": "00"
87+
}
88+
},
89+
"creationDate": {
90+
"$date": {
91+
"$numberLong": "1552949630483"
92+
}
93+
},
94+
"keyAltNames": [
95+
"altname",
96+
"another_altname"
97+
]
98+
}
99+
],
100+
"tests": [
101+
{
102+
"description": "Insert a document with auto encryption using the AWS provider with temporary credentials",
103+
"clientOptions": {
104+
"autoEncryptOpts": {
105+
"kmsProviders": {
106+
"awsTemporary": {}
107+
}
108+
}
109+
},
110+
"operations": [
111+
{
112+
"name": "insertOne",
113+
"arguments": {
114+
"document": {
115+
"_id": 1,
116+
"encrypted_string": "string0"
117+
}
118+
}
119+
}
120+
],
121+
"expectations": [
122+
{
123+
"command_started_event": {
124+
"command": {
125+
"listCollections": 1,
126+
"filter": {
127+
"name": "default"
128+
}
129+
},
130+
"command_name": "listCollections"
131+
}
132+
},
133+
{
134+
"command_started_event": {
135+
"command": {
136+
"find": "datakeys",
137+
"filter": {
138+
"$or": [
139+
{
140+
"_id": {
141+
"$in": [
142+
{
143+
"$binary": {
144+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
145+
"subType": "04"
146+
}
147+
}
148+
]
149+
}
150+
},
151+
{
152+
"keyAltNames": {
153+
"$in": []
154+
}
155+
}
156+
]
157+
},
158+
"$db": "keyvault"
159+
},
160+
"command_name": "find"
161+
}
162+
},
163+
{
164+
"command_started_event": {
165+
"command": {
166+
"insert": "default",
167+
"documents": [
168+
{
169+
"_id": 1,
170+
"encrypted_string": {
171+
"$binary": {
172+
"base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
173+
"subType": "06"
174+
}
175+
}
176+
}
177+
],
178+
"ordered": true
179+
},
180+
"command_name": "insert"
181+
}
182+
}
183+
],
184+
"outcome": {
185+
"collection": {
186+
"data": [
187+
{
188+
"_id": 1,
189+
"encrypted_string": {
190+
"$binary": {
191+
"base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
192+
"subType": "06"
193+
}
194+
}
195+
}
196+
]
197+
}
198+
}
199+
},
200+
{
201+
"description": "Insert with invalid temporary credentials",
202+
"clientOptions": {
203+
"autoEncryptOpts": {
204+
"kmsProviders": {
205+
"awsTemporaryNoSessionToken": {}
206+
}
207+
}
208+
},
209+
"operations": [
210+
{
211+
"name": "insertOne",
212+
"arguments": {
213+
"document": {
214+
"_id": 1,
215+
"encrypted_string": "string0"
216+
}
217+
},
218+
"result": {
219+
"errorContains": "security token"
220+
}
221+
}
222+
]
223+
}
224+
]
225+
}

‎test/spec/client-side-encryption/tests/awsTemporary.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
runOn:
2+
- minServerVersion: "4.1.10"
3+
database_name: &database_name "default"
4+
collection_name: &collection_name "default"
5+
6+
data: []
7+
json_schema: {'properties': {'encrypted_w_altname': {'encrypt': {'keyId': '/altname', 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}, 'random': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'}}, 'encrypted_string_equivalent': {'encrypt': {'keyId': [{'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}], 'bsonType': 'string', 'algorithm': 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'}}}, 'bsonType': 'object'}
8+
key_vault_data: [{'status': 1, '_id': {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}}, 'masterKey': {'provider': 'aws', 'key': 'arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0', 'region': 'us-east-1'}, 'updateDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyMaterial': {'$binary': {'base64': 'AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO', 'subType': '00'}}, 'creationDate': {'$date': {'$numberLong': '1552949630483'}}, 'keyAltNames': ['altname', 'another_altname']}]
9+
10+
tests:
11+
- description: "Insert a document with auto encryption using the AWS provider with temporary credentials"
12+
clientOptions:
13+
autoEncryptOpts:
14+
kmsProviders:
15+
awsTemporary: {}
16+
operations:
17+
- name: insertOne
18+
arguments:
19+
document: &doc0 { _id: 1, encrypted_string: "string0" }
20+
expectations:
21+
# Auto encryption will request the collection info.
22+
- command_started_event:
23+
command:
24+
listCollections: 1
25+
filter:
26+
name: *collection_name
27+
command_name: listCollections
28+
# Then key is fetched from the key vault.
29+
- command_started_event:
30+
command:
31+
find: datakeys
32+
filter: { $or: [ { _id: { $in: [ {'$binary': {'base64': 'AAAAAAAAAAAAAAAAAAAAAA==', 'subType': '04'}} ] } }, { keyAltNames: { $in: [] } } ] }
33+
$db: keyvault
34+
command_name: find
35+
- command_started_event:
36+
command:
37+
insert: *collection_name
38+
documents:
39+
- &doc0_encrypted { _id: 1, encrypted_string: {'$binary': {'base64': 'AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==', 'subType': '06'}} }
40+
ordered: true
41+
command_name: insert
42+
outcome:
43+
collection:
44+
# Outcome is checked using a separate MongoClient without auto encryption.
45+
data:
46+
- *doc0_encrypted
47+
- description: "Insert with invalid temporary credentials"
48+
clientOptions:
49+
autoEncryptOpts:
50+
kmsProviders:
51+
awsTemporaryNoSessionToken: {}
52+
operations:
53+
- name: insertOne
54+
arguments:
55+
document: *doc0
56+
result:
57+
errorContains: "security token"

0 commit comments

Comments
 (0)