ClientEncryption.createEncryptedCollection() (mongosh method)

Create Your Encrypted Connection

1. Start mongosh

   Run:

   mongosh --nodb

   --nodb means don't connect to a database.

2. Generate a Key String

   Generate a base 64 96-byte string:

   const TEST_LOCAL_KEY = require("crypto").randomBytes(96).toString("base64")

3. Create an Encryption Options Object

   To create a client-side field level encryption options object, use the TEST_LOCAL_KEY string from the previous step:

      var autoEncryptionOpts = {
         "keyVaultNamespace" : "encryption.__dataKeys",
         "kmsProviders" : {
            "local" : {
               "key" : BinData(0, TEST_LOCAL_KEY)
            }
         }
      }

4. Create an Encrypted Client Object

   To create an encrypted client object, use the Mongo() constructor. Replace the mongodb://myMongo.example.net URI with the connection string URI for the target cluster. For example:

   encryptedClient = Mongo(
      "mongodb://myMongo.example.net:27017/?replSetName=myMongo",
      autoEncryptionOpts
   )

Specify which Fields to Encrypt

Create an encryptedFieldsMaps to specify which fields to encrypt:

const encryptedFieldsMap = {
  encryptedFields: {
    fields: [
      {
        path: "secretField",
        bsonType: "string",
        queries: { queryType: "equality" },
      },
    ],
  },
};

Create Your Encrypted Collection

Create an encrypted enc.users collection:

clientEncryption = encryptedClient.getClientEncryption();

var result = clientEncryption.createEncryptedCollection(
  "enc",
  "users",
  {
    provider: "local",
    createCollectionOptions: encryptedFieldsMap,
    masterKey: {} // masterKey is optional when provider is local
  }
)

Check Your Result Object

createEncryptedCollection returns a large result object with many fields. Check the value of result.collection to confirm the collection was created in the desired location.

enc> result.collection
enc.users