Amazon DocumentDB connections

Amazon DocumentDB is MongoDB-compatible. DataMasque masks Amazon DocumentDB collections in place.

• Required privileges
• Encrypted connections

Required privileges

A DataMasque connection for Amazon DocumentDB requires:

• A user with readWrite role on the target database.

use admin
db.createUser({
  user: "<connection user>",
  pwd: "<password>",
  roles: [{ role: "readWrite", db: "<target database>" }]
})

Amazon DocumentDB connections use the same parameters as MongoDB connections, with the following considerations:

• Amazon DocumentDB CA Certificate: Amazon DocumentDB presents a certificate signed by the Amazon RDS certificate authority, which is not in the system trust store. Upload the Amazon RDS CA bundle and select it under Advanced Settings once TLS is enabled. See MongoDB Encrypted Connections for the upload procedure.
• Retryable writes are disabled automatically for Amazon DocumentDB connections, because DocumentDB rejects them and a masking run would otherwise fail at write time.

For more information, see AWS's documentation: https://docs.aws.amazon.com/documentdb/latest/developerguide/connect.html.

Encrypted connections

Amazon DocumentDB uses the same encrypted connection settings as MongoDB. See MongoDB connections -> Encrypted connections.