Navigation

Rotate your AWS Customer Master Key

Note
Feature unavailable in Free and Shared-Tier Clusters

This feature is not available for M0 free clusters, M2, and M5 clusters. To learn more about which features are unavailable, see Atlas M0 (Free Cluster), M2, and M5 Limitations.

Important
Serverless Instances are in Preview

Serverless instances are in preview and do not support this feature at this time. To learn more, see Serverless Instance Limitations.

When you use your own cloud provider KMS, Atlas automatically rotates the MongoDB master keys every 90 days. These keys are rotated on a rolling basis and the process does not require the data to be rewritten.

Atlas does not automatically rotate the AWS customer master key (CMK) used for AWS-provided Encryption at Rest.

Atlas automatically creates an alert to remind you to rotate your CMK every 90 days by default when you enable Encryption at Rest for an Atlas project.

AWS KMS supports automatic CMK rotation. AWS automatic CMK rotation does not require you to update the Atlas Encryption at Rest project settings, including the CMK ID.

This page explains how to create a new key and update the CMK ID in Atlas to rotate your Atlas project CMK. This method of key rotation supports more granular control of the rotation period compared to AWS KMS automatic CMK rotation.

Important
Cloud Backups with Encryption at Rest

For clusters using Encryption at Rest and Cloud Backups, Atlas uses the project's CMK and AWS IAM user credentials at the time of the snapshot to automatically encrypt the snapshot data files. This is an additional layer of encryption on the existing encryption applied to all Atlas storage and snapshot volumes.

Atlas does not re-encrypt snapshots with the new CMK after rotation. Do not delete the old CMK until you check every backup-enabled cluster in the project for any snapshots still using that CMK. Atlas deletes backups in accordance to the Snapshot Scheduling and Retention Policy. After Atlas deletes all snapshots depending on a given CMK, you can delete that CMK safely.

1

Navigate to the Advanced page for your project.

  1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.
  2. If it is not already displayed, select your desired project from the Projects menu in the navigation bar.
  3. Click Advanced in the sidebar.
2
3

  1. Enter the following information:

    Field
    Action
    AWS IAM role
    Select an existing AWS IAM role or authorize a new role. See Enable Role-Based Access to Your Encryption Key for a Project to learn more about authorizing a new IAM role for Atlas to access your AWS KMS keys for encryption at rest.
    Customer Master Key ID

    Enter your AWS customer master key ID.

    Important

    You must update the key policy to give the IAM user supporting Atlas Encryption at Rest the following permissions to access the provided CMK:

    Customer Master Key Region

    Select the AWS region in which you created your AWS CMK.

    Note

    Atlas only lists AWS regions that support AWS KMS.

  2. Click Save.

Atlas displays a banner in the Atlas console during the CMK rotation process. Do not delete or disable the CMK until your changes have deployed.

© MongoDB, Inc 2008-present. MongoDB, Mongo, and the leaf logo are registered trademarks of MongoDB, Inc.

Give Feedback