Use Automatic Queryable Encryption with AWS使用AWS的自动可查询加密

Log in to your AWS Management Console.登录您的AWS管理控制台。

Navigate to the AWS KMS Console.导航至AWS KMS控制台。

Create your Customer Master Key创建客户主键

Create a new symmetric key by following the official AWS documentation on Creating symmetric KMS keys. 按照AWS关于创建对称KMS键的官方文档创建一个新的对称键。The key you create is your Customer Master Key. 您创建的键是您的客户主键。Choose a name and description that helps you identify it; these fields do not affect the functionality or configuration of your CMK.选择一个有助于识别它的名称和描述；这些字段不会影响CMK的功能或配置。

In the Usage Permissions step of the key generation process, apply the following default key policy that enables Identity and Access Management (IAM) policies to grant access to your Customer Master Key:在键生成过程的“使用权限”步骤中，应用以下默认键策略，该策略启用身份和访问管理（IAM）策略以授予对客户主键的访问权限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<ARN of your AWS account principal>"
      },
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}

Navigate to the AWS IAM Console.导航至AWS IAM控制台。

Create an IAM User创建IAM用户

Create a new programmatic IAM user in the AWS management console by following the official AWS documentation on Adding a User. 按照AWS关于添加用户的官方文档，在AWS管理控制台中创建一个新的编程IAM用户。You will use this IAM user as a service account for your Queryable Encryption enabled application. 您将使用此IAM用户作为启用可查询加密的应用程序的服务帐户。Your application authenticates with AWS KMS using the IAM user to encrypt and decrypt your Data Encryption Keys (DEKs) with your Customer Master Key (CMK).您的应用程序通过AWS KMS进行身份验证，使用IAM用户使用您的客户主键（CMK）加密和解密您的数据加密键（DEK）。

Grant Permissions授予权限

Grant your IAM user kms:Encrypt and kms:Decrypt permissions for your remote master key.为您的IAM用户授予远程主键的kms:Encrypt和kms:Decrypt权限。

The following inline policy allows an IAM user to encrypt and decrypt with the Customer Master Key with the least privileges possible:以下内联策略允许IAM用户以最低权限使用客户主键进行加密和解密：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["kms:Decrypt", "kms:Encrypt"],
      "Resource": "<the Amazon Resource Name (ARN) of your remote master key>"
    }
  ]
}

To apply the preceding policy to your IAM user, follow the Adding IAM identity permissions guide in the AWS documentation.要将上述策略应用于IAM用户，请遵循AWS文档中的添加IAM身份权限指南。

Add Your AWS KMS Credentials添加您的AWS KMS凭据

Create a variable containing your AWS Key Management Service credentials with the following structure. Use the Access Key ID and Secret Access Key you created in the Create an IAM User step of this tutorial.使用以下结构创建一个包含您的AWS键管理服务凭据的变量。使用您在本教程的创建IAM用户步骤中创建的访问键ID和键。

kmsProviders = {
  aws: {
    accessKeyId: process.env.AWS_ACCESS_KEY_ID, // Your AWS access key ID
    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, // Your AWS secret access key
  },
};

Add your Customer Master Key Credentials添加您的客户主键凭据

Create a variable containing your Customer Master Key credentials with the following structure. Use the ARN and Region you recorded in the Create a Customer Master Key step of this tutorial.使用以下结构创建一个包含客户主键凭据的变量。使用您在本教程的创建客户主键步骤中记录的ARN和区域。

customerMasterKeyCredentials = {
  key: process.env.AWS_KEY_ARN, // Your AWS Key ARN
  region: process.env.AWS_KEY_REGION, // Your AWS Key Region
};

Set Your Automatic Encryption Options设置自动加密选项

const sharedLibraryPathOptions = {
  cryptSharedLibPath: process.env.SHARED_LIB_PATH, // Path to your Automatic Encryption Shared Library
};

const autoEncryptionOptions = {
  keyVaultNamespace,
  kmsProviders,
  sharedLibraryPathOptions,
};

Create a Client to Set Up an Encrypted Collection创建客户端以设置加密集合

To create a client used to encrypt and decrypt data in your collection, instantiate a new MongoClient by using your connection URI and your automatic encryption options.要创建一个用于加密和解密集合中数据的客户端，请使用连接URI和自动加密选项实例化一个新的MongoClient。

const encryptedClient = new MongoClient(uri, {
  autoEncryption: autoEncryptionOptions,
});

Specify Fields to Encrypt指定要加密的字段

To encrypt a field, add it to the encrypted fields map. To enable queries on a field, add the "queries" property. Create the encrypted fields map as follows:若要加密字段，请将其添加到加密字段映射中。要在字段上启用查询，请添加“查询”属性。按如下方式创建加密字段映射：

const encryptedFieldsMap = {
  encryptedFields: {
    fields: [
      {
        path: "patientRecord.ssn",
        bsonType: "string",
        queries: { queryType: "equality" },
      },
      {
        path: "patientRecord.billing",
        bsonType: "object",
      },
    ],
  },
};

Create the Collection创建集合

Instantiate ClientEncryption to access the API for the encryption helper methods.实例化ClientEncryption以访问加密助手方法的API。

const clientEncryption = new ClientEncryption(client, autoEncryptionOptions);

await clientEncryption.createEncryptedCollection(
  encryptedDatabase,
  encryptedCollectionName,
  {
    provider: kmsProviderName,
    createCollectionOptions: encryptedFieldsMap,
    masterKey: customerMasterKeyCredentials,
  }
);