• Security Features and Setup >
• Encryption at Rest using Customer Key Management >
• Customer Key Management with AWS KMS

Customer Key Management with AWS KMS

Feature unavailable in Free and Shared-Tier Clusters

This feature is not available for M0 (Free Tier), M2, and M5 clusters. To learn more about which features are unavailable, see Atlas M0 (Free Tier), M2, and M5 Limitations.

Atlas uses your AWS customer master key (CMK) in the AWS Key Management Service (KMS) to encrypt and decrypt your MongoDB master keys. These MongoDB master keys are used to encrypt cluster database files and cloud providers snapshots.

When you use your own cloud provider KMS, Atlas automatically rotates the MongoDB master keys every 90 days. These keys are rotated on a rolling basis and the process does not require the data to be rewritten.

Atlas encrypts your data at rest using encrypted storage media. Using keys you manage with AWS KMS, Atlas encrypts your data a second time when it writes it to the MongoDB encrypted storage engine. You use your AWS CMK to encrypt the MongoDB master encryption keys.

This page covers configuring customer key management using AWS KMS on your Atlas project.

You must configure customer key management for the Atlas project before enabling it on clusters in that project.

Prerequisites

To enable customer-managed keys with AWS KMS for a MongoDB project, you must:

• Have an AWS customer master key (CMK). To learn how to create a key, see Creating Keys in the AWS documentation.

• Have an AWS IAM user in the same AWS account used to create the AWS CMK. Atlas must have permission to perform the following actions with your key:

  • DescribeKey
  • Encrypt
  • Decrypt

  To learn how to create an IAM user, see IAM Users in the AWS documentation.

  Atlas uses the same IAM user credentials and CMK settings for all clusters in a project for which Encryption at Rest is enabled.

• Use an M10 or larger cluster.
• Use Cloud Provider Snapshots to encrypt your backup snapshots. Continuous Backups are not supported.

Procedures

Enable Customer-Managed Keys for a Project

You must enable customer key management for a project before you can enable it on a cluster in that project.

1

Log into Atlas.

2

Select a project from the Context menu.

3

In the Security section of the left navigation, click Advanced.

4

Toggle the button next to Encryption at Rest using your Key Management to On.

5

Enter your AWS customer master key ID in Customer Master Key ID.

6

Select the AWS region in which you created your AWS CMK from Customer Master Key Region.

Atlas only lists AWS regions that support AWS KMS.

7

Enter your IAM user’s access key ID in Access Key ID.

8

Enter your IAM user’s secret access key in Secret Access Key.

9

Click Save.

Disable Customer-Managed Keys for a Project

You must disable customer key management on each cluster in a project before you can disable the feature for the project.

Alerts

Atlas automatically creates an customer master key rotation alert once you configure Encryption at Rest for a project.

To reset this alert, Rotate your AWS Customer Master Key.

Related Topics

• To enable Encryption at Rest when deploying an Atlas cluster, see Enable Encryption at Rest.
• To enable Encryption at Rest for an existing Atlas cluster, see Enable Encryption at Rest.
• To rotate the currently configured CMK or changing the IAM user credentials for a Atlas project, see Rotate your AWS Customer Master Key.

• Rotate your AWS Customer Master Key

←   Encryption at Rest using Customer Key Management Rotate your AWS Customer Master Key  →

© MongoDB, Inc 2008-present. MongoDB, Mongo, and the leaf logo are registered trademarks of MongoDB, Inc.