Navigation

Encryption at Rest Using Your Key Management

AWS and Azure Clusters Only

This feature is only available for Atlas M10 or greater replica set clusters deployed on AWS or Azure. Support for sharded clusters and clusters deployed on Google Cloud Project (GCP) are in development.

Atlas encrypts all cluster storage and snapshot volumes, ensuring the security of all cluster data at rest (Encryption at Rest). Atlas Project Owners can configure an additional layer of encryption on their data at rest using the MongoDB Encrypted Storage Engine and their Atlas-compatible Encryption at Rest provider.

Configuring Encryption at Rest using your Key Management incurs additional charges for the Atlas project. To learn more, see Advanced Security.

Atlas Project Owners can use one or more of the following Encryption at Rest providers when configuring Encryption at Rest for the Atlas project:

After configuring at least one Encryption at Rest provider for the Atlas project, Project Owners can enable Encryption at Rest for each Atlas cluster for which they require encryption. The Encryption at Rest provider does not have to match the cluster cloud service provider.

Atlas does not automatically rotate user-managed encryption keys. Defer to your preferred Encryption at Rest provider’s documentation and guidance for best practices on key rotation. Atlas automatically creates a 365-day key rotation alert when you configure Encryption at Rest using your Key Management in an Atlas project.

Encrypted Backups

Atlas encrypts all snapshot volumes, ensuring the security of cluster data at rest (Encryption at Rest). For projects and clusters using Encryption at Rest Using Your Key Management, Atlas applies an additional layer of encryption to your snapshot storage volumes using the Encryption at Rest provider configured for the cluster.

For each cluster with encryption at rest and cloud provider snapshots enabled, Atlas uses the project encryption key at the time of the snapshot to encrypt the snapshot data files.

Atlas can only restore an encrypted snapshot if the project encryption key used to encrypt the snapshot is enabled and accessible through the configured KMS service for the Atlas project.

Atlas does not support enabling Continuous Backups for clusters using encryption at rest.

To learn more about encrypted cloud provider snapshots, see Cloud Provider Snapshots with Encryption at Rest and Restore a Snapshot of a Cluster with Encryption at Rest.