Docs Menu

Customer Key Management with Google Cloud KMS

On this page

  • Prerequisites
  • Alerts
  • Related Topics
Note
Feature unavailable in Free and Shared-Tier Clusters

This feature is not available for M0 free clusters, M2, and M5 clusters. To learn more about which features are unavailable, see Atlas M0 (Free Cluster), M2, and M5 Limitations.

Important
Serverless Instances are in Preview

Serverless instances are in preview and do not support this feature at this time. To learn more, see Serverless Instance Limitations.

Atlas uses your GCP Service Account Key to encrypt and decrypt your MongoDB master keys. These MongoDB master keys are used to encrypt cluster database files and cloud providers snapshots.

When you use your own cloud provider KMS, Atlas automatically rotates the MongoDB master keys every 90 days. These keys are rotated on a rolling basis and the process does not require the data to be rewritten.

Atlas encrypts your data at rest using encrypted storage media. Using keys you manage with GCP KMS, Atlas encrypts your data a second time when it writes it to the MongoDB encrypted storage engine. You use your GCP SAK to encrypt the MongoDB master encryption keys.

This page covers configuring customer key management using GCP on your Atlas project.

You must configure customer key management for the Atlas project before enabling it on clusters in that project.

To enable customer-managed keys with GCP KMS for a MongoDB project, you must have:

  • Your symmetric GCP Service Account Key.
  • The Key Version Resource ID associated with your Service Account Key.
  • A GCP service account with credentials specified in your Service Account Key with sufficient permissions to:

    • Get the Service Account Key version
    • Encrypt data with the Service Account Key version
    • Decrypt data with the Service Account Key
    Note

    The key, not the key version, handles decryption.

  • If your GCP KMS configuration requires it, allow access from Atlas IP addresses and the public IP addresses or DNS hostnames of your cluster nodes so that Atlas can communicate with your KMS. If the node IP addresses change, you must update your configuration to avoid connectivity interruptions.
Tip

You must enable customer key management for a project before you can enable it on a cluster in that project.

1
  1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.
  2. If it is not already displayed, select your desired project from the Projects menu in the navigation bar.
  3. Click Advanced in the sidebar.
2
3
4

Your Service Account Key should be formatted as a JSON object. It contains the encryption credentials for your GCP service account.

5

Your key version resource ID is the fully-qualified resource name for a CryptoKeyVersion.

6

After you Enable Customer-Managed Keys for a Project, you must enable customer key management for each Atlas cluster that contains data that you want to encrypt.

Note

You must have the Project Owner role to enable customer key management for clusters in that project.

For new clusters, toggle the Manage your own encryption keys setting to Yes when you create the cluster.

For existing clusters:

1
  1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.
  2. If it is not already displayed, select your desired project from the Projects menu in the navigation bar.
  3. If the Database Deployments page is not already displayed, click Databases in the sidebar.
2

For the cluster that contains data that you want to encrypt, click the ellipses ..., then select Edit Configuration.

3
  1. Expand the Additional Settings panel.
  2. Toggle the Manage your own encryption keys setting to Yes.
4
  1. Click Review Changes.
  2. Review your changes, then click Apply Changes to update your cluster.

Atlas automatically creates an encryption key rotation alert once you configure customer key management for a project. You can reset this alert at any time by rotating your GCP Key Version Resource ID.

Give Feedback
© 2021 MongoDB, Inc.

About

  • Careers
  • Legal Notices
  • Privacy Notices
  • Security Information
  • Trust Center
© 2021 MongoDB, Inc.