In-Use Encryption Tutorial

Overview

This guide shows you how to connect to your deployment and collections using Queryable Encryption.

This guide uses the air_airlines.json data set in the guided examples. The guide covers the process of importing your data set.

Requirements and Limitations

• In-Use Encryption is an Enterprise/Atlas only feature.
• You need a replica set to use this connection option. Your replica set can be a single node or larger.
• You need to connect to your deployment on Compass using In-Use Encryption. For more information on how to connect to your deployment, see In-Use Encryption Connection tab.

Create Your Encrypted Collection

Once your deployment is connected using In-Use Encryption, create your collection using Queryable Encryption. You can create a new database and collection or you can create a new collection in an existing database.

Queryable Encryption supports new collections only. You can't enable Queryable Encryption on existing collections.

Procedure

1

Click the Create a Database button or the Create a Collection button.

Enter the name of the database and/or collection.

2

Click the Additional preferences drop down.

3

Check the Queryable Encryption box.

4

Specify your Encrypted Fields.

Change the path field value from encryptedField to the name of the field you want encrypted.

Here, the encrypted field is the base field of the air_airlines data set.

For more information, see Encrypted Fields.

5

(Optional) Specify KMS Provider.

6

(Optional) Specify Key Encryption Key.

7

Click Create Database or Create Collection.

Import Your Data

1

Click on your collection on the left-hand navigation banner.

The collection has a Queryable Encryption badge next to its name to indicate that fields in that collection are encrypted.

2

Click Add Data.

3

Click Import File.

4

Select File and Input File Type.

5

Click Import.

Your imported collection is displayed in the document view. The specified encrypted field is marked by a key symbol next to the value.

Here, the base field is marked with the key symbol.

Enable and Disable In-Use Encryption

You can enable and disable In-Use Encryption in your deployment.

When In-Use Encryption is enabled:

• You can modify encrypted values.
• You can insert documents and specified fields will be encrypted.

When In-Use Encryption is disabled:

• You cannot modify encrypted values. Compass displays the values of these fields as a series of asterisks.
• Inserted documents can not encrypt fields.

Disable In-Use Encryption

To disable In-Use Encryption:

1

Click on In-Use Encryption on left-hand navigation bar.

2

Click the Enable In-Use Encryption for this connection toggle.

Disabling In-Use Encryption only affects how Compass accesses your data.