Encryption at Rest using Customer Key Management

In Atlas, go to the Advanced page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Advanced under the Security heading.

   The Advanced page displays.

Toggle the button next to Encryption at Rest using your Key Management to On.

Enter your key management provider account credentials and provide an encryption key.

Click Save.

Allow access to or from the Atlas control plane.

To learn more, see Allow Access From the Atlas Control Plane.

Send a GET request to the returnAllControlPlaneIPAddresses endpoint.

The API endpoint returns a list of inbound and outbound Atlas control plane IP addresses in CIDR categorized by cloud provider and region. To learn more, see the prerequisites for managing customer keys with AWS, Azure, and GCP.

Add the returned outbound IP addresses to your cloud provider's IP access list.

See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.

Enable cluster encryption.

Toggle the Manage your own encryption keys setting to Yes on the cluster configuration form.

Review and apply your changes.

1. Click Review Changes.

2. Review your changes, then click Apply Changes to deploy your cluster.

Optional: Add IP addresses from the new cluster nodes.

Depending on your Key Management configuration, you may have to add Atlas cluster node IP addresses to your cloud provider KMS access list, so that the cluster can communicate with your KMS. To enable communication between the cluster and KMS:

1. Send a GET request to the ipAddresses endpoint. The API endpoint returns a list of IP addresses from the new cluster nodes, similar to the following:

   {
     "groupId": "xxx", // ObjectId
     "services": {
       "clusters": [
         {
           "clusterName": "Cluster0",
           "inbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
             ],
           "outbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
           ]
         }
       ]
     }
   }

2. Add the returned IP addresses to your cloud provider's IP access list. You must modify your IP access list before the provisioning plan rolls back. The cluster attempts provisioning for up to three days before the provisioning plan rolls back from IP access restrictions.

   See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.

   Note

   If you need more time to update the IP access list, you can:

   • Provision the cluster without Encryption at Rest then enable it after you update the IP access list.

   • Configure a more inclusive IP access list on your cloud provider's Key Management Service, launch the cluster with Encryption at Rest, then modify the IP access list.

In Atlas, go to the Clusters page for your project.

1. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your desired project from the Projects menu in the navigation bar.

3. If it's not already displayed, click Clusters in the sidebar.

   The Clusters page displays.

Modify the cluster's configuration.

For the cluster that contains data that you want to encrypt, click the , then select Edit Configuration.

Enable cluster encryption.

1. Expand the Additional Settings panel.

2. Toggle the Manage your own encryption keys setting to Yes.

3. Verify the status of the Require Private Networking setting for your cluster.

   If you configured Encryption at Rest Using CMK (Over Private Networking) for Atlas at the project level, the status is Active. If you haven't configured any private endpoint connection for your project, the status is Inactive.

Review and apply your changes.

1. Click Review Changes.

2. Review your changes, then click Apply Changes to update your cluster.

Add nodes or shards to your replica set cluster or sharded cluster.

You can add electable nodes to M10+ clusters or increase the number of shards in your sharded cluster.

Optional: Add IP addresses from the new cluster nodes or shards.

Depending on your Key Management configuration, you may have to add Atlas cluster node IP addresses to your cloud provider KMS access list, so that the cluster can communicate with your KMS. To enable communication between the cluster and KMS:

1. Send a GET request to the ipAddresses endpoint. The API endpoint returns a list of IP addresses from the new cluster nodes or shards, similar to the following:

   {
     "groupId": "xxx", // ObjectId
     "services": {
       "clusters": [
         {
           "clusterName": "Cluster0",
           "inbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
             ], // List<String>
           "outbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
           ]
         }
       ]
     }
   }

2. Add the returned IP addresses to your cloud provider's IP access list. You must modify your IP access list before the provisioning plan rolls back. The cluster attempts provisioning for up to three days before the provisioning plan rolls back from IP access restrictions.

   See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.