#MONGODB ATLAS HOW TO#

MongoDB will ask which cloud region you want to host your data in, from which Atlas will spin up an on-demand database endpoint which will dynamically flex depending on traffic levels and for which you will only pay per reads and writes. “With serverless instances on MongoDB Atlas, now available in preview, you can automatically get the database resources you need based on your workload demand.”įor users, this means less decisions to make when launching a database. “We want developers to be able to build MongoDB applications without having to think about database infrastructure or capacity management,” MongoDB CTO Mark Porter wrote in a blog post.

Serverless is an emerging cloud architecture which sees third-party providers dynamically allocate the compute and storage resources needed to execute a particular function, meaning developers no longer have to provision or manage their own servers and they only pay for when their functions execute. Listing 2.Popular NoSQL database provider MongoDB is jumping on the serverless computing bandwagon by offering the MongoDB Atlas database-as-a-service (DBaaS) option on a serverless basis for preview customers from today. Now make two new js files called make-dek.js and insert.js, and add the lines in the package.json file like Listing 2. We’ll build the bare minimum to try to keep sight of the forest through the trees.Ĭreate a new NPM app by typing npm init. The MongoDB docs provide a more fully realized version of the app used to create the DEK key vault table here. That’s a lot of encryption going on, but again, the idea is to keep the DEK secure by virtue of the CMK. When making calls against the encrypted application data, your client application retrieves the DEK from the key vault, decrypts the DEK with the CMK, and then uses the decrypted DEK to interact with the database instance. Queryable encryption holds the CMK-encrypted DEK in this collection. We’ll create a simple Node.js program to handle our CMK, create a DEK, and insert the DEK into a special encrypted collection in MongoDB called the key vault. Generate a local key openssl rand 96 > cmk.txt Create a DEK You can do this with the openssl command line tool, as shown in Listing 1. It’s important to note up front that in production, you must use a remote key store or you will undermine the security of the system. When developing an application that will use queryable encryption, you can use a local file that holds your CMK on the same server as the application, instead of a remote key store. If either the CMK or the DEK is lost or inaccessible, then the client application will be unable to decrypt the data. If the CMK is compromised, then your data is vulnerable to compromise. The DEK is used to encrypt the data in the database, while the CMK is used to encrypt and decrypt the DEK, adding a layer of protection. There are two kinds of keys used in MongoDB’s queryable encryption: the customer master key (CMK) and the data encryption keys (DEKs).

#MONGODB ATLAS HOW TO#

This article will show you how to set up a development environment for working with MongoDB queryable encryption in a Node.js application. This quasi-magical capability does require some extra configuration for applications.

Thus MongoDB queryable encryption removes the data store and its infrastructure as targets of attack. The database does not hold the keys to the encrypted data at all, yet it still supports querying that data. Only the client application is capable of decrypting the data. This amounts to a new level of security for data, which remains secure even as it is used within the database. Data is encrypted for the entire round trip: at insert, storage, and query.

MongoDB 6 introduced the capability to query encrypted data in the database.

Mongodb atlas