Docs Menu

Enable and Configure Encryption at Rest using Customer Key Management for One Project

On this page

Note

Groups and projects are synonymous terms. Your {GROUP-ID} is the same as your project ID. For existing groups, your group/project ID remains the same. The resource and corresponding endpoints use the term groups.

Note
Feature unavailable in Free and Shared-Tier Clusters

This feature is not available for M0 free clusters, M2, and M5 clusters. To learn more about which features are unavailable, see Atlas M0 (Free Cluster), M2, and M5 Limitations.

Enables, disables, and configures Encryption at Rest using Customer Key Management for an Atlas project with one of the following providers:

After configuring at least one Encryption at Rest using Customer Key Management provider for the Atlas project, Project Owners can enable Encryption at Rest using Customer Key Management for each Atlas cluster for which they require encryption. The Encryption at Rest using Customer Key Management provider does not have to match the cluster cloud service provider.

Atlas does not automatically rotate user-managed encryption keys. Defer to your preferred Encryption at Rest using Customer Key Management provider's documentation and guidance for best practices on key rotation. Atlas automatically creates a 90-day key rotation alert when you configure Encryption at Rest using Customer Key Management using your Key Management in an Atlas project.

Note

Atlas encrypts all storage whether or not you use your own key management.

Tip
See also:

To learn more about key management, see Encryption at Rest using Customer Key Management, including prerequisites and restrictions.

The Atlas Administration API authenticates using HTTP Digest Authentication. Provide a programmatic API public key and corresponding private key as the username and password when constructing the HTTP request. To learn how to configure API access for an Atlas project, see Get Started with the Atlas Administration API.

https://cloud.mongodb.com/api/atlas/v1.0

PATCH /groups/{GROUP-ID}/encryptionAtRest
Path Element
Necessity
Description
GROUP-ID
Required
Unique identifier for the project.

This endpoint might use any of the HTTP request query parameters available to all Atlas Administration API resources. All of these are optional.

Name
Type
Necessity
Description
Default
pretty
boolean
Optional
Flag indicating whether the response body should be in a prettyprint format.
false
envelope
boolean
Optional

Flag indicating if Atlas should wrap the response in a JSON envelope.

This option may be needed for some API clients. These clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query.

For endpoints that return one result, the response body includes:

status
HTTP response code
envelope
Expected response body
false

The required request body parameters depend on whether Encryption at Rest using Customer Key Management is currently enabled:

  • If you have enabled Encryption at Rest using Customer Key Management, Atlas requires all of the parameters for the desired encryption provider.

    • If you want to use AWS KMS, Atlas requires all the fields in the awsKms document.
    • If you want to use Azure Key Vault, Atlas requires all the fields in the azureKeyVault document.
    • If you want to use Google Cloud KMS, Atlas requires all the fields in the googleCloudKms document.
  • If you have enabled Encryption at Rest using Customer Key Management, administrators can pass only the changed fields for the awsKms, azureKeyVault, or googleCloudKms document to update the configuration to this endpoint.

The following example disables Encryption at Rest using Customer Key Management for an Atlas project:

1curl --user "{PUBLIC-KEY}:{PRIVATE-KEY}" --digest \
2 --header "Accept: application/json" \
3 --header "Content-Type: application/json" \
4 --request PATCH "https://cloud.mongodb.com/api/atlas/v1.0/groups/{GROUP-ID}/encryptionAtRest?pretty=true" \
5 --data '
6 {
7 "awsKms": {
8 "enabled" : false
9 }
10 }'
1{
2 "awsKms" : {
3 "accessKeyID" : null,
4 "customerMasterKeyID" : null,
5 "enabled" : false,
6 "region" : null,
7 "valid" : false
8 },
9 "azureKeyVault" : {
10 "clientID" : null,
11 "enabled" : false,
12 "keyIdentifier" : null,
13 "keyVaultName" : null,
14 "resourceGroupName" : null,
15 "subscriptionID" : null,
16 "tenantID" : null,
17 "valid" : false
18 },
19 "googleCloudKms" : {
20 "enabled": false,
21 "keyVersionResourceID" : null,
22 "valid" : false
23 }
24}
←  Encryption at Rest using Customer Key ManagementGet Configuration for Encryption at Rest using Customer Key Management for One Project →
Give Feedback
© 2022 MongoDB, Inc.

About

  • Careers
  • Investor Relations
  • Legal Notices
  • Privacy Notices
  • Security Information
  • Trust Center
© 2022 MongoDB, Inc.