[Encryption] Cast KMS provider to object to support AWS empty config #2801
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jmikola
approved these changes
Aug 13, 2025
| return [ | ||
| 'kmsProviders' => [$this->attributes['kmsProvider']['type'] => array_diff_key($this->attributes['kmsProvider'], ['type' => 0])], | ||
| // Each kmsProvider must be an object, it can be empty | ||
| 'kmsProviders' => [$this->attributes['kmsProvider']['type'] => (object) array_diff_key($this->attributes['kmsProvider'], ['type' => 0])], |
There was a problem hiding this comment.
Slight correction to the PR description, since you said only mentioned AWS there.
credentialProviders talks about only supporting AWS, but Automatic Credentials mentions that AWS, Azure, and GCP are all supported. The struct definition in kmsProviders also demonstrates that those three provider types might be expressed as an empty object.
I'll also note that libmongocrypt supports named KMS providers (e.g. aws:foo), which in turn do not support fetching automatic credentials from the environment.
I don't think this changes the code you have here, but I wanted to clarify.
There was a problem hiding this comment.
Thanks, I updated the PR description.
GromNaN
merged commit cf3c0b7
into
doctrine:feature/queryable-encryption
19 of 21 checks passed
This was referenced Aug 13, 2025
GromNaN
added a commit
to doctrine/DoctrineMongoDBBundle
that referenced
this pull request
Aug 18, 2025
GromNaN
added a commit
to doctrine/DoctrineMongoDBBundle
that referenced
this pull request
Aug 19, 2025
GromNaN
added a commit
to GromNaN/DoctrineMongoDBBundle
that referenced
this pull request
Aug 20, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
For some KMS providers, all options can be omitted. The authentication is done using the env var or the system.
https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.md#credentialproviders