@@ -74,12 +74,12 @@ enterprise-only feature. If you only intend to use explicit encryption, you may
7474skip this step.
7575
7676Mongocryptd comes pre-packaged with enterprise builds of the MongoDB server
77- (versions 4.2 and newer). For installation instructions, see
78- `the MongoDB manual <https://docs. mongodb.com/manual/reference/security-client-side-encryption-appendix/#installation>`_.
77+ (versions 4.2 and newer). For installation instructions, see the
78+ `MongoDB manual <https://mongodb.com/docs /manual/reference/security-client-side-encryption-appendix/#installation>`_.
7979
8080In order to configure mongocryptd (for example, which port it listens on or the
8181path used to spawn the daemon), it is necessary to pass different options to the
82- ``Mongo::Client`` performing automatic encryption. See the `:extra_options`_
82+ ``Mongo::Client`` performing automatic encryption. See the :ref: `:extra_options <cse-extra-options>`
8383section of this tutorial for more information.
8484
8585Automatic Encryption
@@ -202,11 +202,12 @@ The example above demonstrates using automatic encryption with a local master ke
202202For more information about using the AWS Key Management Service to create a
203203master key and create data keys, see the following sections of this tutorial:
204204
205- - `Creating A Master Key`_
206- - `Creating A Data Key`_
205+ - :ref: `Creating A Master Key <creating-a-master-key>`
206+ - :ref: `Creating A Data Key <creating-a-data-key>`
207207
208208Explicit Encryption
209209===================
210+
210211Explicit encryption is a feature that allows users to encrypt and decrypt
211212individual pieces of data such as strings, integers, or symbols. Explicit
212213encryption is a community feature and does not require an enterprise build
@@ -296,8 +297,8 @@ The example above demonstrates using explicit encryption with a local master key
296297For more information about using the AWS Key Management Service to create a
297298master key and create data keys, see the following sections of this tutorial:
298299
299- - `Creating A Master Key`_,
300- - `Creating A Data Key`_,
300+ - :ref: `Creating A Master Key <creating-a-master-key>`
301+ - :ref: `Creating A Data Key <creating-a-data-key>`
301302
302303Creating a Master Key
303304=====================
@@ -307,8 +308,11 @@ user data. The master key can be generated in one of two ways: by creating a
307308local key, or by creating a key in the Amazon Web Services Key Management
308309Service (AWS KMS).
309310
311+ .. _local-master-key:
312+
310313Local Master Key
311314~~~~~~~~~~~~~~~~
315+
312316A local master key is a 96-byte binary string. It should be persisted
313317on your machine as an environment variable or in a text file.
314318
@@ -329,14 +333,25 @@ AWS Master Key
329333It is recommended that you use Amazon's Key Management Service to create and
330334store your master key. To do so, follow steps 1 and 2 of the
331335:drivers:`"Convert to a Remote Master Key" section</security/client-side-field-level-encryption-local-key-to-kms/#convert-to-a-remote-master-key>`
336+ .. _remote-master-key:
337+
338+ Remote Master Key
339+ ~~~~~~~~~~~~~~~~~
340+ It is recommended that you use a remote Key Management Service to create and
341+ store your master key. To do so, follow steps of the
342+ `"Set up a Remote Master Key" <https://www.mongodb.com/docs/manual/core/csfle/tutorials/#set-up-a-remote-master-key>`_
332343in the MongoDB Client-Side Encryption documentation.
333344
334345For more information about creating a master key, see the
335346:drivers:`Create a Master Key </security/client-side-field-level-encryption-guide/#a-create-a-master-key>`
347+ `Create a Master Key <https://www.mongodb.com/docs/manual/core/csfle/#a.-create-a-master-key>`_
336348section of the MongoDB manual.
337349
350+ .. _creating-a-data-key:
351+
338352Creating a Data Key
339353===================
354+
340355Once you have created a master key, create a data key by calling the
341356``#create_data_key`` method on an instance of the ``Mongo::ClientEncryption``
342357class. This method generates a new data key and inserts it into the key vault
@@ -376,8 +391,8 @@ key with the following code snippet:
376391 data_key_id = client_encryption.create_data_key('local')
377392 # => <BSON::Binary... type=ciphertext...>
378393
379- See the `Local Master Key`_ section for more information about generating a new
380- local master key.
394+ See the :ref: `Local Master Key <local-master-key>` section for more information
395+ about generating a new local master key.
381396
382397Create a Data Key Using an AWS Master Key
383398~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -423,18 +438,20 @@ generating a new master key on AWS and finding the information you need to
423438create data keys.
424439
425440For more information about creating a data key, see the
426- :drivers: `Create a Data Encryption Key </security/client-side-field-level-encryption-guide/#b -create-a-data-encryption-key>`
441+ `Create a Data Encryption Key <https://www.mongodb.com/docs/manual/core/csfle/#b. -create-a-data-encryption-key>`_
427442section of the MongoDB manual.
428443
429444Auto-Encryption Options
430445=======================
446+
431447Automatic encryption can be configured on a ``Mongo::Client`` using the
432448``auto_encryption_options`` option ``Hash``. This section provides an overview
433449of the fields inside ``auto_encryption_options`` and explains how to choose their
434450values.
435451
436452``:key_vault_client``
437453~~~~~~~~~~~~~~~~~~~~~
454+
438455The key vault client is a ``Mongo::Client`` instance that will be used to connect
439456to the MongoDB collection containing your encryption data keys. For example, if
440457your key vault was hosted on a MongoDB instance at ``localhost:30000``:
@@ -456,6 +473,7 @@ to insert and fetch data keys.
456473
457474``:key_vault_namespace``
458475~~~~~~~~~~~~~~~~~~~~~~~~
476+
459477The key vault namespace is a ``String`` in the format ``"database_name.collection_name"``,
460478where ``database_name`` and ``collection_name`` are the name of the database and
461479collection in which you would like to store your data keys. For example, if your data
@@ -474,6 +492,7 @@ There is no default key vault namespace, and this option must be provided.
474492
475493``:schema_map``
476494~~~~~~~~~~~~~~~
495+
477496A schema map is a Hash with information about which fields to automatically
478497encrypt and decrypt.
479498
@@ -549,11 +568,12 @@ When you intend to use your schema map, convert it to a Ruby ``Hash`` using the
549568
550569.. seealso::
551570
552- :drivers: `Specify Encrypted Fields Using JSON Schema</security/client-side-field-level-encryption-guide/ #c-specify-encrypted-fields-using-json-schema>`,
571+ `Specify Encrypted Fields Using JSON Schema <https://www.mongodb.com/docs/manual/core/csfle/ #c-specify-encrypted-fields-using-json-schema>`_ ,
553572 :manual:`Automatic Encryption Rules</reference/security-client-side-automatic-json-schema/>`
554573
555574``:bypass_auto_encryption``
556575~~~~~~~~~~~~~~~~~~~~~~~~~~~
576+
557577The ``:bypass_auto_encryption`` option is a ``Boolean`` that specifies whether the
558578``Mongo::Client`` should skip encryption when writing to the database. If
559579``:bypass_auto_encryption`` is ``true``, the client will still perform automatic
@@ -568,8 +588,11 @@ decryption of any previously-encrypted data.
568588 }
569589 )
570590
591+ .. _cse-extra-options:
592+
571593``:extra_options``
572594~~~~~~~~~~~~~~~~~~
595+
573596``:extra_options`` is a ``Hash`` of options related to spawning mongocryptd.
574597Every option in this ``Hash`` has a default value, so it is only necessary to
575598provide the options whose defaults you want to override.
0 commit comments