Mongo() (mongosh method方法)

(Optional) The MongoDB cluster hosting the key vault collection.（可选）托管键保管库集合的MongoDB集群。

Specify a Mongo() connection object pointing to the cluster:指定一个指向集群的Mongo()连接对象：

var keyVaultClient = Mongo(<MongoDB URI>);

var autoEncryptionOptions = {
  "keyVaultClient" : keyVaultClient,
  "keyVaultNamespace" : "<database>.<collection>",
  "kmsProviders" : { ... }
}

If keyVaultClient is omitted, the host specified to the Mongo() object containing the autoEncryptionOpts document is used as the key vault host.如果省略了keyVaultClient，则将为包含autoEncryptionOpts文档的Mongo()对象指定的主机用作键库主机。

(Required) The Key Management Service (KMS) used by client-side field level encryption for managing a Customer Master Key (CMK). （必需）客户端字段级加密用于管理客户主键（CMK）的键管理服务（KMS）。Client-side field level encryption uses the CMK for encrypting and decrypting data encryption keys.客户端字段级加密使用CMK来加密和解密数据加密键。

Client-Side Field Level Encryption supports the following KMS providers:客户端字段级加密支持以下KMS提供程序：

• Amazon Web Services KMS
• Azure Key Vault
• Google Cloud Platform KMS
• Locally Managed Key

If possible, consider defining the credentials provided in kmsProviders as environment variables, and then passing them to mongosh using the --eval option. 如果可能的话，考虑将kmsProviders中提供的凭据定义为环境变量，然后使用--eval选项将其传递给mongosh。This minimizes the chances of credentials leaking into logs. See Create a Data Key for examples of this approach for each supported KMS.这最大限度地减少了凭据泄露到日志中的可能性。有关每个受支持的KMS的此方法的示例，请参阅创建数据键。

Amazon Web Services KMS亚马逊网络服务KMS

IMPORTANT: For AWS KMS support, use mongosh, or the MongoDB 4.2.2 or later legacy mongo shell. 对于AWS KMS支持，请使用mongosh或MongoDB 4.2.2或更高版本的遗留mongo shell。The 4.2.0 and 4.2.1 legacy mongo shell do not support the AWS KMS service due to an unexpected change in the KMS response object. 由于KMS响应对象发生意外更改，4.2.0和4.2.1旧版mongo shell不支持AWS KMS服务。See SERVER-44721 for more information.有关更多信息，请参阅SERVER-44721。

Specify the aws document to kmsProviders with the following fields:使用以下字段向kmsProviders指定aws文档：

"kmsProviders" : {
   "aws" : {
     "accessKeyId" : "AWSAccessKeyId",
     "secretAccessKey" : "AWSSecretAccessKey"
   }
 }

The specified accessKeyId must correspond to an IAM user with all List and Read permissions for the KMS service.指定的accessKeyId必须对应于具有KMS服务的所有List和Read权限的IAM用户。

In some environments, the AWS SDK can pick up credentials automatically. To enable AWS KMS usage without providing explicit credentials to the AWS SDK, you can pass the kmsProvider details to the Mongo() constructor.在某些环境中，AWS SDK可以自动获取凭据。要在不向AWS SDK提供显式凭据的情况下启用AWS KMS使用，您可以将kmsProvider详细信息传递给Mongo()构造函数。

{
  "kmsProviders" : { "aws" : { } }
}

Azure Key VaultAzure 键保管库

Specify the azure document to kmsProviders with the following fields:使用以下字段指定kmsProviders的azure文档：

"kmsProviders" : {
  "azure" : {
    "tenantId" : "AzureTenantId",
    "clientId" : "AzureClientId",
    "clientSecret" : "AzureClientSecret"
  }
}

New in version 5.0.在版本5.0中新增。

Google Cloud KMS谷歌云KMS

Specify the gcp document to kmsProviders with the following fields:使用以下字段将gcp文档指定给kmsProviders：

"kmsProviders" : {
  "gcp" : {
    "email" : "GCPEmail",
    "privateKey" : "GCPPrivateKey"
  }
}

New in version 5.0.在版本5.0中新增。

Locally Managed Key本地管理键

Specify the local document to kmsProviders with the following field:使用以下字段指定kmsProviders的local文档：

"kmsProviders" : {
  "local" : {
     "key" : BinData(0, "<96 byte base-64 encoded key>")
  }
}

The specified key must be a base64-encoded 96-byte string with no newline characters.指定的键必须是base64编码的96字节字符串，没有换行符。

(Optional) The automatic client-side field level encryption rules specified using the JSON schema Draft 4 standard syntax and encryption-specific keywords. （可选）使用JSON模式Draft 4标准语法和加密特定键指定的自动客户端字段级加密规则。This option is mutually exclusive with explicitEncryptionOnly. If a collection is present on both the schemaMap and the encryptedFieldsMap, libmongocrypt errors on initialization.此选项与explicitEncryptionOnly互斥。如果schemaMap和encryptedFieldsMap上都存在集合，则初始化时libmongocrypt会出错。

For complete documentation, see Encryption Schemas.有关完整文档，请参阅加密模式。

(Optional) The map of collection namespaces to encryptedFields documents. encryptedFields is a BSON document that describes the Queryable Encryption encrypted fields. （可选）集合命名空间到encryptedFields文档的映射。encryptedFields是一个描述可查询加密加密字段的BSON文档。If a collection is present on both the schemaMap and the encryptedFieldsMap, libmongocrypt errors on initialization.如果schemaMap和encryptedFieldsMap上都存在集合，则初始化时libmongocrypt会出错。

To learn more about encrypted fields in Queryable Encryption, see Encrypted Fields and Enabled Queries.要了解有关可查询加密中加密字段的更多信息，请参阅加密字段和已启用查询。

If true:

• Using a command that is not part of the declared API version returns an APIStrictError error.使用不属于声明的API版本的命令将返回APIStrictError错误。
• Indexes that are unsupported by the Stable API are ignored by the query planner.查询计划器将忽略Stable API不支持的索引。

If you specify strict, you must also specify version.若指定strict，则还必须指定version。

If not specified, defaults to false.如果未指定，则默认为false。

If true, using a command or behavior that is deprecated in the specified API version returns an APIDeprecationError. If you specify deprecationErrors, you must also specify version.如果为true，则使用指定API版本中不推荐使用的命令或行为将返回APIDeprecationError。如果指定deprecentErrors，则还必须指定version。

If not specified, defaults to false.如果未指定，则默认为false。