Description

Ensure each Atlas cluster's data at rest is encrypted, either with Encryption at Rest using your Key Management (AWS KMS, Azure Key Vault, or Google Cloud KMS) or with cloud provider volume encryption such as AWS EBS volume encryption. Customer key management adds a layer of encryption with keys you control.

Rationale

Encryption at rest protects data on disks and in backups if storage is accessed without authorization. Using your own key management service also gives you control over the keys, including the ability to revoke access to the data by disabling the key, and supports compliance requirements.

Impact

  • Data and backups are encrypted with keys you control

  • Access to data can be revoked by disabling the key

  • Adds hourly cost; if Atlas loses access to the key, the cluster becomes inaccessible and unrecoverable

Default Value

Atlas encrypts all cluster storage and snapshot volumes by default. Encryption at Rest using your Key Management is an added layer that is off by default and must be configured for the project first, then for each M10+ replica set cluster.

Pre-Requisites

  • Project Owner role

  • An M10 or higher cluster

  • A key in AWS KMS, Azure Key Vault, or Google Cloud KMS, with credentials Atlas can use

Test Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. In the sidebar, click Advanced. The Advanced page displays.

  5. Check whether Encryption at Rest using your Key Management is On for the project.

  6. In the sidebar, click Clusters, find the cluster, and click Edit Configuration.

  7. Expand the Additional Settings panel.

  8. Check whether Encryption using your Key Management (M10 and up) is set to Yes.

  9. Alternatively, use the Atlas Administration API or the Atlas CLI (https://www.mongodb.com/docs/atlas/cli/current/). Run GET /api/atlas/v2/groups/{groupId}/clusters/{clusterName} and check that encryptionAtRestProvider is AWS, AZURE, or GCP.

  10. If encryption at rest is not configured, follow the implementation steps.

Implementation Steps

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. In the sidebar, click Advanced. The Advanced page displays.

  5. Toggle the button next to Encryption at Rest using your Key Management to On, choose your provider, enter the key details and credentials, and save.

  6. In the sidebar, click Clusters, find the cluster, and click Edit Configuration.

  7. Expand the Additional Settings panel.

  8. Toggle Encryption using your Key Management (M10 and up) to Yes.

  9. Click Review Changes, then click Apply Changes.

Backout Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, click Clusters, find the cluster, and click Edit Configuration.

  4. Expand the Additional Settings panel.

  5. Toggle Encryption using your Key Management (M10 and up) to No, then click Review Changes and Apply Changes. You need a valid key to disable it.

Reference