MongoDB Atlas - Encryption at Rest

Welcome to the community @Ka_Tech!

MongoDB Atlas always uses cloud provider storage encryption by default. This is volume-level encryption at rest (for example, EBS Encryption on AWS). In free/shared tier clusters (M0, M2, M5) the underlying MongoDB instances are shared so you cannot configure encryption options. The industry standard for cloud provider encryption is AES-256, but you can confirm the exact details referring to AWS, GCP, or Azure documentation as appropriate.

If you have a dedicated cluster (M10+), you can enable and configure the Enterprise Encryption at Rest feature which is cluster-specific encryption for additional security including user-managed encryption keys. With this feature enabled, your data files will be encrypted using the Encrypted Storage Engine (which is in addition to the underlying cloud provider storage encryption).

For example, if you are using Encryption at Rest with AWS KMS:

Atlas encrypts your data at rest using encrypted storage media. Using keys you manage with AWS KMS, Atlas encrypts your data a second time when it writes it to the MongoDB encrypted storage engine. You use your AWS Customer Master Key (CMK) to encrypt the MongoDB master encryption keys. Oplog data is also encrypted with your CMK.

For more information, please refer to How does MongoDB Atlas secure my data? in the Atlas FAQ. The MongoDB Atlas Security white paper also goes into further detail.

Regards,
Stennie

1 Like