Skip to content

Commit 99a4f28

Browse files
ShaneHarveyShaneHarvey
authored
PYTHON-2539 Test AWS temporary credentials via "sessionToken" for CSFLE (#569)
1 parent 9597461 commit 99a4f28

File tree

7 files changed

+287
-18
lines changed

7 files changed

+287
-18
lines changed

‎.evergreen/config.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,10 @@ functions:
375375
export FLE_AZURE_CLIENTSECRET="${fle_azure_clientsecret}"
376376
export FLE_GCP_EMAIL="${fle_gcp_email}"
377377
export FLE_GCP_PRIVATEKEY="${fle_gcp_privatekey}"
378+
# Needed for generating temporary aws credentials.
379+
export AWS_ACCESS_KEY_ID="${fle_aws_key}"
380+
export AWS_SECRET_ACCESS_KEY="${fle_aws_secret}"
381+
export AWS_DEFAULT_REGION=us-east-1
378382
EOT
379383
fi
380384
- command: shell.exec

‎.evergreen/run-tests.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,9 @@ if [ -n "$TEST_ENCRYPTION" ]; then
134134
python -c "import pymongocrypt; print('libmongocrypt version: '+pymongocrypt.libmongocrypt_version())"
135135
# PATH is updated by PREPARE_SHELL for access to mongocryptd.
136136

137+
# Get access to the AWS temporary credentials:
138+
# CSFLE_AWS_TEMP_ACCESS_KEY_ID, CSFLE_AWS_TEMP_SECRET_ACCESS_KEY, CSFLE_AWS_TEMP_SESSION_TOKEN
139+
. $DRIVERS_TOOLS/.evergreen/csfle/set-temp-creds.sh
137140
fi
138141

139142
if [ -z "$DATA_LAKE" ]; then

‎.evergreen/test-encryption-requirements.txt

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
cffi>=1.12.0,<2
2-
cryptography>=2,<4
2+
cryptography>=2
3+
# boto3 is required by drivers-evergreen-tools/.evergreen/csfle/set-temp-creds.sh
4+
boto3<2

‎pymongo/encryption.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -371,7 +371,8 @@ def __init__(self, kms_providers, key_vault_namespace, key_vault_client,
371371
372372
- `aws`: Map with "accessKeyId" and "secretAccessKey" as strings.
373373
These are the AWS access key ID and AWS secret access key used
374-
to generate KMS messages.
374+
to generate KMS messages. An optional "sessionToken" may be
375+
included to support temporary AWS credentials.
375376
- `azure`: Map with "tenantId", "clientId", and "clientSecret" as
376377
strings. Additionally, "identityPlatformEndpoint" may also be
377378
specified as a string (defaults to 'login.microsoftonline.com').

‎pymongo/encryption_options.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ def __init__(self, kms_providers, key_vault_namespace,
5858
5959
- `aws`: Map with "accessKeyId" and "secretAccessKey" as strings.
6060
These are the AWS access key ID and AWS secret access key used
61-
to generate KMS messages.
61+
to generate KMS messages. An optional "sessionToken" may be
62+
included to support temporary AWS credentials.
6263
- `azure`: Map with "tenantId", "clientId", and "clientSecret" as
6364
strings. Additionally, "identityPlatformEndpoint" may also be
6465
specified as a string (defaults to 'login.microsoftonline.com').

‎test/client-side-encryption/spec/awsTemporary.json

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
{
2+
"runOn": [
3+
{
4+
"minServerVersion": "4.1.10"
5+
}
6+
],
7+
"database_name": "default",
8+
"collection_name": "default",
9+
"data": [],
10+
"json_schema": {
11+
"properties": {
12+
"encrypted_w_altname": {
13+
"encrypt": {
14+
"keyId": "/altname",
15+
"bsonType": "string",
16+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
17+
}
18+
},
19+
"encrypted_string": {
20+
"encrypt": {
21+
"keyId": [
22+
{
23+
"$binary": {
24+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
25+
"subType": "04"
26+
}
27+
}
28+
],
29+
"bsonType": "string",
30+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
31+
}
32+
},
33+
"random": {
34+
"encrypt": {
35+
"keyId": [
36+
{
37+
"$binary": {
38+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
39+
"subType": "04"
40+
}
41+
}
42+
],
43+
"bsonType": "string",
44+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Random"
45+
}
46+
},
47+
"encrypted_string_equivalent": {
48+
"encrypt": {
49+
"keyId": [
50+
{
51+
"$binary": {
52+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
53+
"subType": "04"
54+
}
55+
}
56+
],
57+
"bsonType": "string",
58+
"algorithm": "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic"
59+
}
60+
}
61+
},
62+
"bsonType": "object"
63+
},
64+
"key_vault_data": [
65+
{
66+
"status": 1,
67+
"_id": {
68+
"$binary": {
69+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
70+
"subType": "04"
71+
}
72+
},
73+
"masterKey": {
74+
"provider": "aws",
75+
"key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
76+
"region": "us-east-1"
77+
},
78+
"updateDate": {
79+
"$date": {
80+
"$numberLong": "1552949630483"
81+
}
82+
},
83+
"keyMaterial": {
84+
"$binary": {
85+
"base64": "AQICAHhQNmWG2CzOm1dq3kWLM+iDUZhEqnhJwH9wZVpuZ94A8gEqnsxXlR51T5EbEVezUqqKAAAAwjCBvwYJKoZIhvcNAQcGoIGxMIGuAgEAMIGoBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDHa4jo6yp0Z18KgbUgIBEIB74sKxWtV8/YHje5lv5THTl0HIbhSwM6EqRlmBiFFatmEWaeMk4tO4xBX65eq670I5TWPSLMzpp8ncGHMmvHqRajNBnmFtbYxN3E3/WjxmdbOOe+OXpnGJPcGsftc7cB2shRfA4lICPnE26+oVNXT6p0Lo20nY5XC7jyCO",
86+
"subType": "00"
87+
}
88+
},
89+
"creationDate": {
90+
"$date": {
91+
"$numberLong": "1552949630483"
92+
}
93+
},
94+
"keyAltNames": [
95+
"altname",
96+
"another_altname"
97+
]
98+
}
99+
],
100+
"tests": [
101+
{
102+
"description": "Insert a document with auto encryption using the AWS provider with temporary credentials",
103+
"clientOptions": {
104+
"autoEncryptOpts": {
105+
"kmsProviders": {
106+
"awsTemporary": {}
107+
}
108+
}
109+
},
110+
"operations": [
111+
{
112+
"name": "insertOne",
113+
"arguments": {
114+
"document": {
115+
"_id": 1,
116+
"encrypted_string": "string0"
117+
}
118+
}
119+
}
120+
],
121+
"expectations": [
122+
{
123+
"command_started_event": {
124+
"command": {
125+
"listCollections": 1,
126+
"filter": {
127+
"name": "default"
128+
}
129+
},
130+
"command_name": "listCollections"
131+
}
132+
},
133+
{
134+
"command_started_event": {
135+
"command": {
136+
"listCollections": 1,
137+
"filter": {
138+
"name": "datakeys"
139+
},
140+
"$db": "keyvault"
141+
},
142+
"command_name": "listCollections"
143+
}
144+
},
145+
{
146+
"command_started_event": {
147+
"command": {
148+
"find": "datakeys",
149+
"filter": {
150+
"$or": [
151+
{
152+
"_id": {
153+
"$in": [
154+
{
155+
"$binary": {
156+
"base64": "AAAAAAAAAAAAAAAAAAAAAA==",
157+
"subType": "04"
158+
}
159+
}
160+
]
161+
}
162+
},
163+
{
164+
"keyAltNames": {
165+
"$in": []
166+
}
167+
}
168+
]
169+
},
170+
"$db": "keyvault"
171+
},
172+
"command_name": "find"
173+
}
174+
},
175+
{
176+
"command_started_event": {
177+
"command": {
178+
"insert": "default",
179+
"documents": [
180+
{
181+
"_id": 1,
182+
"encrypted_string": {
183+
"$binary": {
184+
"base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
185+
"subType": "06"
186+
}
187+
}
188+
}
189+
],
190+
"ordered": true
191+
},
192+
"command_name": "insert"
193+
}
194+
}
195+
],
196+
"outcome": {
197+
"collection": {
198+
"data": [
199+
{
200+
"_id": 1,
201+
"encrypted_string": {
202+
"$binary": {
203+
"base64": "AQAAAAAAAAAAAAAAAAAAAAACwj+3zkv2VM+aTfk60RqhXq6a/77WlLwu/BxXFkL7EppGsju/m8f0x5kBDD3EZTtGALGXlym5jnpZAoSIkswHoA==",
204+
"subType": "06"
205+
}
206+
}
207+
}
208+
]
209+
}
210+
}
211+
},
212+
{
213+
"description": "Insert with invalid temporary credentials",
214+
"clientOptions": {
215+
"autoEncryptOpts": {
216+
"kmsProviders": {
217+
"awsTemporaryNoSessionToken": {}
218+
}
219+
}
220+
},
221+
"operations": [
222+
{
223+
"name": "insertOne",
224+
"arguments": {
225+
"document": {
226+
"_id": 1,
227+
"encrypted_string": "string0"
228+
}
229+
},
230+
"result": {
231+
"errorContains": "security token"
232+
}
233+
}
234+
]
235+
}
236+
]
237+
}

0 commit comments

Comments
 (0)