Encryption at Rest using Customer Key Management

In Atlas, go to the Advanced page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Advanced under the Security heading.

Toggle the button next to Encryption at Rest using your Key Management to On.

Enter your key management provider account credentials and provide an encryption key.

Click Save.

Allow access to or from the Atlas control plane.

Depending on your Key Management Service configuration, you may have to add Atlas control plane IP addresses to enable Encryption at Rest for your project so that Atlas can communicate with your KMS. To enable communication between Atlas and KMS:

1. Send a GET request to the returnAllControlPlaneIPAddresses endpoint. The API endpoint returns a list of inbound and outbound Atlas control plane IP addresses in CIDR categorized by cloud provider and region, similar to the following:

   {
     "controlPlane": {
       "inbound": {
         "aws": { // cloud provider
           "us-east-1": [ // region
             "3.92.113.229/32",
             "3.208.110.31/32",
             "107.22.44.69/32"
             ...,
           ],
           ...
         }
       },
       "outbound": {
         "aws": { // cloud provider
           "us-east-1": [ // region
             "3.92.113.229/32",
             "3.208.110.31/32",
             "107.22.44.69/32"
             ...,
           ],
           ...
         }
       }
     },
     "data_federation": {
       "inbound": {},
       "outbound" {}
     },
     "app_services": {
       "inbound": {},
       "outbound" {}
     },
     ...
   }

2. Add the returned IP addresses to your cloud provider's IP access list. See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.

Enable cluster encryption.

Toggle the Manage your own encryption keys setting to Yes on the cluster configuration form.

Review and apply your changes.

1. Click Review Changes.

2. Review your changes, then click Apply Changes to deploy your cluster.

Optional: Add IP addresses from the new cluster nodes.

Depending on your Key Management configuration, you may have to add Atlas cluster node IP addresses to your cloud provider KMS access list, so that the cluster can communicate with your KMS. To enable communication between the cluster and KMS:

1. Send a GET request to the ipAddresses endpoint. The API endpoint returns a list of IP addresses from the new cluster nodes, similar to the following:

   {
     "groupId": "xxx", // ObjectId
     "services": {
       "clusters": [
         {
           "clusterName": "Cluster0",
           "inbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
             ],
           "outbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
           ]
         }
       ]
     }
   }

2. Add the returned IP addresses to your cloud provider's IP access list. You must modify your IP access list before the provisioning plan rolls back. The cluster attempts provisioning for up to three days before the provisioning plan rolls back from IP access restrictions.

   See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.

   Note

   If you need more time to update the IP access list, you can:

   • Provision the cluster without Encryption at Rest then enable it after you update the IP access list.

   • Configure a more inclusive IP access list on your cloud provider's Key Management Service, launch the cluster with Encryption at Rest, then modify the IP access list.

In Atlas, go to the Clusters page for your project.

1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

2. If it is not already displayed, select your desired project from the Projects menu in the navigation bar.

3. If the Clusters page is not already displayed, click Database in the sidebar.

Add IP addresses from your cluster nodes.

Depending on your Key Management Service configuration, you may have to add Atlas cluster node IP addresses to your cloud provider KMS list, so that the cluster can communicate with your KMS. To enable communication between the cluster and KMS:

1. Send a GET request to the ipAddresses endpoint. The API endpoint returns a list of IP addresses from the existing cluster nodes, similar to the following:

   {
     "groupId": "xxx", // ObjectId
     "services": {
       "clusters": [
         {
           "clusterName": "Cluster0",
           "inbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
             ],
           "outbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
           ]
         }
       ]
     }
   }

2. Add the returned IP addresses to your cloud provider's IP access list. See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.

Modify the cluster's configuration. For the cluster that contains data that you want to encrypt, click the ellipses ..., then select Edit Configuration.

Enable cluster encryption.

1. Expand the Additional Settings panel.

2. Toggle the Manage your own encryption keys setting to Yes.

Review and apply your changes.

1. Click Review Changes.

2. Review your changes, then click Apply Changes to update your cluster.

Add nodes or shards to your replica set cluster or sharded cluster.

You can add electable nodes to M10+ clusters or increase the number of shards in your sharded cluster.

Optional: Add IP addresses from the new cluster nodes or shards.

Depending on your Key Management configuration, you may have to add Atlas cluster node IP addresses to your cloud provider KMS access list, so that the cluster can communicate with your KMS. To enable communication between the cluster and KMS:

1. Send a GET request to the ipAddresses endpoint. The API endpoint returns a list of IP addresses from the new cluster nodes or shards, similar to the following:

   {
     "groupId": "xxx", // ObjectId
     "services": {
       "clusters": [
         {
           "clusterName": "Cluster0",
           "inbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
             ], // List<String>
           "outbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
           ]
         }
       ]
     }
   }

2. Add the returned IP addresses to your cloud provider's IP access list. You must modify your IP access list before the provisioning plan rolls back. The cluster attempts provisioning for up to three days before the provisioning plan rolls back from IP access restrictions.

   See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.