AWS documentdb documentation change

Service: documentdb · 2026-03-31 · Documentation low

File: documentdb/latest/developerguide/KEEP.md

Summary

Added comprehensive documentation for the $$KEEP system variable used with the $redact stage in aggregation pipelines, including examples in MongoDB Shell, Node.js, and Python

Security assessment

This change documents the $$KEEP system variable used with $redact stage for document redaction, which is a data security feature for controlling access to sensitive fields in documents. The examples show how to filter documents based on access levels (public/private), demonstrating data access control patterns. However, there is no evidence this addresses a specific security vulnerability or incident - it's standard feature documentation.

Diff

diff --git a/documentdb/latest/developerguide/KEEP.md b/documentdb/latest/developerguide/KEEP.md
index 8b1378917..5277477ef 100644
--- a//documentdb/latest/developerguide/KEEP.md
+++ b//documentdb/latest/developerguide/KEEP.md
@@ -0,0 +1 @@
+[](/pdfs/documentdb/latest/developerguide/developerguide.pdf#KEEP "Open PDF")
@@ -1,0 +3,143 @@
+[Documentation](/index.html)[Amazon DocumentDB](/documentdb/index.html)[Developer Guide](what-is.html)
+
+Example (MongoDB Shell)Code examples
+
+# $$KEEP
+
+The `$$KEEP` system variable is used with the `$redact` stage in the aggregation pipeline to keep the current document or field unchanged and include it in the output.
+
+**Parameters**
+
+None
+
+## Example (MongoDB Shell)
+
+The following example demonstrates the usage of `$$KEEP` in an Amazon DocumentDB aggregation pipeline. Documents are only kept if access equals "public", otherwise they are removed.
+
+**Create sample documents**
+    
+    
+    db.articles.insertMany([
+      { title: "Article A", access: "public", content: "Visible content" },
+      { title: "Article B", access: "private", content: "Hidden content" }
+    ]);
+
+**Query example**
+    
+    
+    db.articles.aggregate([
+      {
+        $redact: {
+          $cond: [
+            { $eq: ["$access", "public"] },
+            "$$KEEP",
+            "$$PRUNE"
+          ]
+        }
+      }
+    ]);
+
+**Output**
+    
+    
+    [
+      {
+        "_id" : ObjectId("..."),
+        "title" : "Article A",
+        "access" : "public",
+        "content" : "Visible content"
+      }
+    ]
+
+## Code examples
+
+To view a code example for using the `$$KEEP` command, choose the tab for the language that you want to use:
+
+Node.js
+    
+    
+    
+    const { MongoClient } = require('mongodb');
+    
+    async function run() {
+      const client = new MongoClient(
+        'mongodb://<username>:<password>@<cluster-endpoint>:27017/?tls=true&tlsCAFile=global-bundle.pem&replicaSet=rs0'
+      );
+    
+      try {
+        await client.connect();
+        const db = client.db('test');
+        const articles = db.collection('articles');
+    
+        const pipeline = [
+          {
+            $redact: {
+              $cond: [
+                { $eq: ["$access", "public"] },
+                "$$KEEP",
+                "$$PRUNE"
+              ]
+            }
+          }
+        ];
+    
+        const results = await articles.aggregate(pipeline).toArray();
+        console.log(results);
+      } finally {
+        await client.close();
+      }
+    }
+    
+    run().catch(console.error);
+
+Python
+    
+    
+    
+    from pymongo import MongoClient
+    
+    client = MongoClient(
+        "mongodb://<username>:<password>@<cluster-endpoint>:27017/?tls=true&tlsCAFile=global-bundle.pem&replicaSet=rs0"
+    )
+    
+    db = client.test
+    articles = db.articles
+    
+    pipeline = [
+        {
+            "$redact": {
+                "$cond": [
+                    {"$eq": ["$access", "public"]},
+                    "$$KEEP",
+                    "$$PRUNE"
+                ]
+            }
+        }
+    ]
+    
+    results = list(articles.aggregate(pipeline))
+    print(results)
+    
+    client.close()
+
+![Warning](https://d1ge0kk1l5kms0.cloudfront.net/images/G/01/webservices/console/warning.png) **Javascript is disabled or is unavailable in your browser.**
+
+To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.
+
+[Document Conventions](/general/latest/gr/docconventions.html)
+
+$$DESCEND
+
+$$PRUNE
+
+Did this page help you? - Yes
+
+Thanks for letting us know we're doing a good job!
+
+If you've got a moment, please tell us what we did right so we can do more of it.
+
+Did this page help you? - No
+
+Thanks for letting us know this page needs work. We're sorry we let you down.
+
+If you've got a moment, please tell us how we can make the documentation better.