Skip to content

RUBY-3886 Migrate FLE/CSFLE test secrets to AWS Secrets Manager #3048

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
comandeo-mongo wants to merge 4 commits into
base: master
Choose a base branch
from
+47 −76
Draft

RUBY-3886 Migrate FLE/CSFLE test secrets to AWS Secrets Manager #3048

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8f7b27c
RUBY-3672 Use AWS Secrets Manager for AWS auth test credentials
comandeo-mongo May 20, 2026
d232e34
RUBY-3886 Migrate FLE/CSFLE test secrets to AWS Secrets Manager
comandeo-mongo May 20, 2026
2c48a4c
Merge remote-tracking branch 'upstream/master' into ruby-3886
comandeo-mongo May 21, 2026
94274b8
RUBY-3886 Unset empty AWS_SESSION_TOKEN after sourcing secrets-export.sh
comandeo-mongo May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 16 additions & 37 deletions .evergreen/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,13 +173,6 @@ functions:
working_dir: "src"
script: |
${PREPARE_SHELL}
# Needed for generating temporary aws credentials.
if [ -n "${FLE}" ];
then
export AWS_ACCESS_KEY_ID="${fle_aws_key}"
export AWS_SECRET_ACCESS_KEY="${fle_aws_secret}"
export AWS_DEFAULT_REGION="${fle_aws_region}"
fi
export CSOT_SPEC_TESTS=1
unset TOPOLOGY
export TOPOLOGY=${MLAUNCH_TOPOLOGY}
Expand All @@ -201,33 +194,14 @@ functions:
.evergreen/run-tests.sh

"export FLE credentials":
- command: shell.exec
- command: subprocess.exec
type: test
params:
silent: true
binary: bash
working_dir: "src"
script: |
cat <<EOT > .env.private
MONGO_RUBY_DRIVER_AWS_KEY="${fle_aws_key}"
MONGO_RUBY_DRIVER_AWS_SECRET="${fle_aws_secret}"
MONGO_RUBY_DRIVER_AWS_REGION="${fle_aws_region}"
MONGO_RUBY_DRIVER_AWS_ARN="${fle_aws_arn}"

MONGO_RUBY_DRIVER_AZURE_TENANT_ID="${fle_azure_tenant_id}"
MONGO_RUBY_DRIVER_AZURE_CLIENT_ID="${fle_azure_client_id}"
MONGO_RUBY_DRIVER_AZURE_CLIENT_SECRET="${fle_azure_client_secret}"
MONGO_RUBY_DRIVER_AZURE_IDENTITY_PLATFORM_ENDPOINT="${fle_azure_identity_platform_endpoint}"
MONGO_RUBY_DRIVER_AZURE_KEY_VAULT_ENDPOINT="${fle_azure_key_vault_endpoint}"
MONGO_RUBY_DRIVER_AZURE_KEY_NAME="${fle_azure_key_name}"

MONGO_RUBY_DRIVER_GCP_EMAIL="${fle_gcp_email}"
MONGO_RUBY_DRIVER_GCP_PRIVATE_KEY="${fle_gcp_private_key}"
MONGO_RUBY_DRIVER_GCP_PROJECT_ID="${fle_gcp_project_id}"
MONGO_RUBY_DRIVER_GCP_LOCATION="${fle_gcp_location}"
MONGO_RUBY_DRIVER_GCP_KEY_RING="${fle_gcp_key_ring}"
MONGO_RUBY_DRIVER_GCP_KEY_NAME="${fle_gcp_key_name}"
MONGO_RUBY_DRIVER_MONGOCRYPTD_PORT="${fle_mongocryptd_port}"
EOT
include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, DRIVERS_TOOLS]
args:
- "${DRIVERS_TOOLS}/.evergreen/csfle/setup-secrets.sh"

"export Kerberos credentials":
- command: shell.exec
Expand Down Expand Up @@ -368,12 +342,17 @@ functions:
working_dir: "src"
script: |
${PREPARE_SHELL}
# Needed for generating temporary aws credentials.
if [ -n "${FLE}" ];
then
export AWS_ACCESS_KEY_ID="${fle_aws_key}"
export AWS_SECRET_ACCESS_KEY="${fle_aws_secret}"
export AWS_DEFAULT_REGION="${fle_aws_region}"
if [ -n "${FLE}" ]; then
export MONGO_RUBY_DRIVER_AWS_REGION="${fle_aws_region}"
export MONGO_RUBY_DRIVER_AWS_ARN="${fle_aws_arn}"
export MONGO_RUBY_DRIVER_AZURE_IDENTITY_PLATFORM_ENDPOINT="${fle_azure_identity_platform_endpoint}"
export MONGO_RUBY_DRIVER_AZURE_KEY_VAULT_ENDPOINT="${fle_azure_key_vault_endpoint}"
export MONGO_RUBY_DRIVER_AZURE_KEY_NAME="${fle_azure_key_name}"
export MONGO_RUBY_DRIVER_GCP_PROJECT_ID="${fle_gcp_project_id}"
export MONGO_RUBY_DRIVER_GCP_LOCATION="${fle_gcp_location}"
export MONGO_RUBY_DRIVER_GCP_KEY_RING="${fle_gcp_key_ring}"
export MONGO_RUBY_DRIVER_GCP_KEY_NAME="${fle_gcp_key_name}"
export MONGO_RUBY_DRIVER_MONGOCRYPTD_PORT="${fle_mongocryptd_port}"
fi
unset TOPOLOGY
export TOPOLOGY=${MLAUNCH_TOPOLOGY}
Expand Down
53 changes: 16 additions & 37 deletions .evergreen/config/common.yml.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,13 +170,6 @@ functions:
working_dir: "src"
script: |
${PREPARE_SHELL}
# Needed for generating temporary aws credentials.
if [ -n "${FLE}" ];
then
export AWS_ACCESS_KEY_ID="${fle_aws_key}"
export AWS_SECRET_ACCESS_KEY="${fle_aws_secret}"
export AWS_DEFAULT_REGION="${fle_aws_region}"
fi
export CSOT_SPEC_TESTS=1
unset TOPOLOGY
export TOPOLOGY=${MLAUNCH_TOPOLOGY}
Expand All @@ -198,33 +191,14 @@ functions:
.evergreen/run-tests.sh

"export FLE credentials":
- command: shell.exec
- command: subprocess.exec
type: test
params:
silent: true
binary: bash
working_dir: "src"
script: |
cat <<EOT > .env.private
MONGO_RUBY_DRIVER_AWS_KEY="${fle_aws_key}"
MONGO_RUBY_DRIVER_AWS_SECRET="${fle_aws_secret}"
MONGO_RUBY_DRIVER_AWS_REGION="${fle_aws_region}"
MONGO_RUBY_DRIVER_AWS_ARN="${fle_aws_arn}"

MONGO_RUBY_DRIVER_AZURE_TENANT_ID="${fle_azure_tenant_id}"
MONGO_RUBY_DRIVER_AZURE_CLIENT_ID="${fle_azure_client_id}"
MONGO_RUBY_DRIVER_AZURE_CLIENT_SECRET="${fle_azure_client_secret}"
MONGO_RUBY_DRIVER_AZURE_IDENTITY_PLATFORM_ENDPOINT="${fle_azure_identity_platform_endpoint}"
MONGO_RUBY_DRIVER_AZURE_KEY_VAULT_ENDPOINT="${fle_azure_key_vault_endpoint}"
MONGO_RUBY_DRIVER_AZURE_KEY_NAME="${fle_azure_key_name}"

MONGO_RUBY_DRIVER_GCP_EMAIL="${fle_gcp_email}"
MONGO_RUBY_DRIVER_GCP_PRIVATE_KEY="${fle_gcp_private_key}"
MONGO_RUBY_DRIVER_GCP_PROJECT_ID="${fle_gcp_project_id}"
MONGO_RUBY_DRIVER_GCP_LOCATION="${fle_gcp_location}"
MONGO_RUBY_DRIVER_GCP_KEY_RING="${fle_gcp_key_ring}"
MONGO_RUBY_DRIVER_GCP_KEY_NAME="${fle_gcp_key_name}"
MONGO_RUBY_DRIVER_MONGOCRYPTD_PORT="${fle_mongocryptd_port}"
EOT
include_expansions_in_env: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, DRIVERS_TOOLS]
args:
- "${DRIVERS_TOOLS}/.evergreen/csfle/setup-secrets.sh"

"export Kerberos credentials":
- command: shell.exec
Expand Down Expand Up @@ -365,12 +339,17 @@ functions:
working_dir: "src"
script: |
${PREPARE_SHELL}
# Needed for generating temporary aws credentials.
if [ -n "${FLE}" ];
then
export AWS_ACCESS_KEY_ID="${fle_aws_key}"
export AWS_SECRET_ACCESS_KEY="${fle_aws_secret}"
export AWS_DEFAULT_REGION="${fle_aws_region}"
if [ -n "${FLE}" ]; then
export MONGO_RUBY_DRIVER_AWS_REGION="${fle_aws_region}"
export MONGO_RUBY_DRIVER_AWS_ARN="${fle_aws_arn}"
export MONGO_RUBY_DRIVER_AZURE_IDENTITY_PLATFORM_ENDPOINT="${fle_azure_identity_platform_endpoint}"
export MONGO_RUBY_DRIVER_AZURE_KEY_VAULT_ENDPOINT="${fle_azure_key_vault_endpoint}"
export MONGO_RUBY_DRIVER_AZURE_KEY_NAME="${fle_azure_key_name}"
export MONGO_RUBY_DRIVER_GCP_PROJECT_ID="${fle_gcp_project_id}"
export MONGO_RUBY_DRIVER_GCP_LOCATION="${fle_gcp_location}"
export MONGO_RUBY_DRIVER_GCP_KEY_RING="${fle_gcp_key_ring}"
export MONGO_RUBY_DRIVER_GCP_KEY_NAME="${fle_gcp_key_name}"
export MONGO_RUBY_DRIVER_MONGOCRYPTD_PORT="${fle_mongocryptd_port}"
fi
unset TOPOLOGY
export TOPOLOGY=${MLAUNCH_TOPOLOGY}
Expand Down
14 changes: 12 additions & 2 deletions .evergreen/run-tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,8 +236,18 @@ if test -n "$FLE"; then
python3 -u .evergreen/csfle/fake_azure.py &
python3 -u .evergreen/csfle/kms_failpoint_server.py --port 9003 &

# Obtain temporary AWS credentials
PYTHON=python3 . .evergreen/csfle/set-temp-creds.sh
# Source FLE credentials generated by csfle/setup-secrets.sh.
if test -f secrets-export.sh; then
# shellcheck disable=SC1091
. ./secrets-export.sh
export MONGO_RUBY_DRIVER_AWS_KEY="${FLE_AWS_KEY}"
export MONGO_RUBY_DRIVER_AWS_SECRET="${FLE_AWS_SECRET}"
Comment on lines +240 to +247
export MONGO_RUBY_DRIVER_AZURE_TENANT_ID="${FLE_AZURE_TENANTID}"
export MONGO_RUBY_DRIVER_AZURE_CLIENT_ID="${FLE_AZURE_CLIENTID}"
export MONGO_RUBY_DRIVER_AZURE_CLIENT_SECRET="${FLE_AZURE_CLIENTSECRET}"
export MONGO_RUBY_DRIVER_GCP_EMAIL="${FLE_GCP_EMAIL}"
export MONGO_RUBY_DRIVER_GCP_PRIVATE_KEY="${FLE_GCP_PRIVATEKEY}"
fi

if [[ "$FLE" == "helper" || "$FLE" == "mongocryptd" ]]; then
echo "Using helper gem"
Expand Down
Loading