From dc49a941388582333c3e643d4cbf560410b02472 Mon Sep 17 00:00:00 2001 From: Andrew Feierabend Date: Thu, 8 Apr 2021 13:28:30 -0400 Subject: [PATCH] DOCSP-15532 fix 4.4.5 merge conflicts with NextGen --- ...-client-side-encryption-key-management.txt | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/source/core/security-client-side-encryption-key-management.txt b/source/core/security-client-side-encryption-key-management.txt index 9c39efc9187..a420cbe37a0 100644 --- a/source/core/security-client-side-encryption-key-management.txt +++ b/source/core/security-client-side-encryption-key-management.txt @@ -71,8 +71,7 @@ Key must have at least one policy with the following actions: `(reference) `__ -.. admonition:: Implement Principle of Least Privilege for KMS Access - :class: note +.. note:: Implement Principle of Least Privilege for KMS Access Consider configuring IAM user roles such that MongoDB has only the access to the actions and resources required to function. @@ -210,29 +209,30 @@ The :binary:`~bin.mongo` shell provides helper methods for data encryption key management: .. list-table:: - :widths: 40 40 + :header-rows: 1 + :widths: 60 40 + + * - Use Case + - Helper Methods * - Retrieving data encryption keys - - - - :method:`KeyVault.getKey()` - - :method:`KeyVault.getKeys()` - - :method:`KeyVault.getKeyByAltName()` + - | :method:`KeyVault.getKey()` + | :method:`KeyVault.getKeys()` + | :method:`KeyVault.getKeyByAltName()` * - Creating or Modifying data encryption keys - - - - :method:`KeyVault.createKey()` - - :method:`KeyVault.addKeyAlternateName()` - - :method:`KeyVault.removeKeyAlternateName()` + - | :method:`KeyVault.createKey()` + | :method:`KeyVault.addKeyAlternateName()` + | :method:`KeyVault.removeKeyAlternateName()` * - Removing data encryption keys - + - :method:`KeyVault.deleteKey()` + .. important:: Removing a data encryption key renders all fields encrypted using that data encryption key as permanently unreadable. - - - - :method:`KeyVault.deleteKey()` Applications with :authrole:`read` access to the key vault collection can retrieve data encryption keys by querying the collection. However, @@ -245,7 +245,7 @@ vault. Applications must have access to both the remote key vault cluster and the connection cluster to perform client-side field level encryption operations. -data encryption keys have the following structure: +Data encryption keys have the following structure: .. code-block:: json