AWS documentdb documentation change

Service: documentdb · 2026-03-31 · Documentation low

File: documentdb/latest/developerguide/redact.md

Summary

Added comprehensive documentation for the $redact aggregation stage in Amazon DocumentDB, including parameters, examples in MongoDB Shell, Node.js, and Python, and usage scenarios for controlling data visibility based on field values.

Security assessment

The change documents the $redact aggregation stage, which is a security feature used for data redaction and controlling visibility of sensitive information based on access levels or user permissions. While this adds security-related documentation about a feature that can be used to implement security controls, there is no evidence in the diff that this change addresses a specific security vulnerability, weakness, or incident. The documentation provides examples of using $redact to filter data based on status fields, which can help implement data access controls and prevent unauthorized data exposure.

Diff

diff --git a/documentdb/latest/developerguide/redact.md b/documentdb/latest/developerguide/redact.md
index 8b1378917..9f4a5cadb 100644
--- a//documentdb/latest/developerguide/redact.md
+++ b//documentdb/latest/developerguide/redact.md
@@ -0,0 +1 @@
+[](/pdfs/documentdb/latest/developerguide/developerguide.pdf#redact "Open PDF")
@@ -1,0 +3,141 @@
+[Documentation](/index.html)[Amazon DocumentDB](/documentdb/index.html)[Developer Guide](what-is.html)
+
+Example (MongoDB Shell)Code examples
+
+# $redact
+
+The `$redact` aggregation stage in Amazon DocumentDB is used to selectively include or exclude content from the output documents based on the values of specified fields. This is particularly useful in scenarios where you need to control the visibility of sensitive data based on access levels or user permissions.
+
+**Parameters**
+
+  * `$cond`: An expression that evaluates to either `$$KEEP`, `$$PRUNE`, or `$$DESCEND` for each field in the document.
+
+  * `$$KEEP`: Retains the current field in the output document.
+
+  * `$$PRUNE`: Removes the current field from the output document.
+
+  * `$$DESCEND`: Recursively applies the `$redact` stage to the current field, which is an object or array.
+
+
+
+
+## Example (MongoDB Shell)
+
+In this example, we'll use the `$redact` stage to filter orders based on their status, showing only orders with specific status values.
+
+**Create sample documents**
+    
+    
+    db.orders.insert([
+      { "_id": 1, "status": "shipped", "customer": "Carlos Salazar", "total": 150.00, "date": "2025-01-15" },
+      { "_id": 2, "status": "processing", "customer": "Saanvi Sarkar", "total": 89.99, "date": "2025-01-20" },
+      { "_id": 3, "status": "cancelled", "customer": "Zhang Wei", "total": 220.50, "date": "2025-01-18" }
+    ])
+
+**Query example**
+    
+    
+    db.orders.aggregate([
+      {
+        $redact: {
+          $cond: {
+            if: { $in: ["$status", ["shipped", "processing"]] },
+            then: "$$KEEP",
+            else: "$$PRUNE"
+          }
+        }
+      }
+    ])
+
+**Output**
+    
+    
+    [
+      { _id: 1, status: 'shipped', customer: 'Carlos Salazar', total: 150, date: '2025-01-15' },
+      { _id: 2, status: 'processing', customer: 'Saanvi Sarkar', total: 89.99, date: '2025-01-20' }
+    ]
+
+In this example, the `$redact` stage checks the value of the `status` field in each document. If the `status` is "shipped" or "processing", the document is kept (`$$KEEP`). Otherwise, the document is pruned (`$$PRUNE`).
+
+## Code examples
+
+To view a code example for using the `$redact` command, choose the tab for the language that you want to use:
+
+Node.js
+    
+    
+    
+    const { MongoClient } = require('mongodb');
+    
+    async function example() {
+      const client = await MongoClient.connect('mongodb://<username>:<password>@<cluster-endpoint>:27017/?tls=true&tlsCAFile=global-bundle.pem&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false');
+      const db = client.db('test');
+      const collection = db.collection('orders');
+    
+      const result = await collection.aggregate([
+        {
+          $redact: {
+            $cond: {
+              if: { $in: ['$status', ['shipped', 'processing']] },
+              then: '$$KEEP',
+              else: '$$PRUNE'
+            }
+          }
+        }
+      ]).toArray();
+    
+      console.log(result);
+      client.close();
+    }
+    
+    example();
+
+Python
+    
+    
+    
+    from pymongo import MongoClient
+    
+    def example():
+        client = MongoClient('mongodb://<username>:<password>@<cluster-endpoint>:27017/?tls=true&tlsCAFile=global-bundle.pem&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false')
+        db = client['test']
+        collection = db['orders']
+    
+        result = list(collection.aggregate([
+            {
+                '$redact': {
+                    '$cond': {
+                        'if': { '$in': ['$status', ['shipped', 'processing']] },
+                        'then': '$$KEEP',
+                        'else': '$$PRUNE'
+                    }
+                }
+            }
+        ]))
+    
+        print(result)
+        client.close()
+    
+    example()
+
+![Warning](https://d1ge0kk1l5kms0.cloudfront.net/images/G/01/webservices/console/warning.png) **Javascript is disabled or is unavailable in your browser.**
+
+To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.
+
+[Document Conventions](/general/latest/gr/docconventions.html)
+
+$range
+
+$reduce
+
+Did this page help you? - Yes
+
+Thanks for letting us know we're doing a good job!
+
+If you've got a moment, please tell us what we did right so we can do more of it.
+
+Did this page help you? - No
+
+Thanks for letting us know this page needs work. We're sorry we let you down.
+
+If you've got a moment, please tell us how we can make the documentation better.