Manage Customer Keys with Google Cloud KMS

Navigate to the Advanced page for your project.

1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

2. If it is not already displayed, select your desired project from the Projects menu in the navigation bar.

3. Click Advanced in the sidebar.

Toggle the button next to Encryption at Rest using your Key Management to On.

Select Google Cloud KMS.

Enter your Service Account Key.

Your Service Account Key should be formatted as a JSON object. It contains the encryption credentials for your GCP service account.

Enter the Key Version Resource ID.

Your key version resource ID is the fully-qualified resource name for a CryptoKeyVersion.

Click Save.

Navigate to the Database Deployments page for your project.

1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

2. If it is not already displayed, select your desired project from the Projects menu in the navigation bar.

3. If the Database Deployments page is not already displayed, click Database in the sidebar.

Optional: Add IP addresses from your cluster nodes.

Depending on your Key Management Service configuration, you may have to add Atlas cluster node IP addresses to your cloud provider KMS list, so that the cluster can communicate with your KMS. To enable communication between the cluster and KMS:

1. Send a GET request to the ipAddresses endpoint. The API endpoint returns a list of IP addresses from the existing cluster nodes, similar to the following:

   {
     "groupId": "xxx", // ObjectId
     "services": {
       "clusters": [
         {
           "clusterName": "Cluster0",
           "inbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
             ],
           "outbound": [
             "3.92.113.229",
             "3.208.110.31",
             "107.22.44.69"
           ]
         }
       ]
     }
   }

2. Add the returned IP addresses to your cloud provider's IP access list. See the prerequisites for managing customer keys with AWS, Azure, and GCP for more information.

Modify the cluster's configuration.

For the cluster that contains data that you want to encrypt, click the ellipses ..., then select Edit Configuration.

Enable cluster encryption.

1. Expand the Additional Settings panel.

2. Toggle the Manage your own encryption keys setting to Yes.

Review and apply your changes.

1. Click Review Changes.

2. Review your changes, then click Apply Changes to update your cluster.

Navigate to the Advanced page for your project.

1. If it is not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.

2. If it is not already displayed, select your desired project from the Projects menu in the navigation bar.

3. Click Advanced in the sidebar.

Click Edit .

Update the GCP Key details.

1. Click Google Cloud KMS if the Google Cloud KMS tab is not already active.

2. Expand Encryption Key Credentials if the Encryption Key Credentials dialog is not already displayed.

3. Enter the GCP Key Version Resource ID in the Key Identifier entry.

   Include the fully-qualified resource name for a CryptoKeyVersion.

   Example

   projects/my-project-0/locations/us-east4/keyRings/my-key-ring-0/cryptoKeys/my-key-0/cryptoKeyVersions/1

   The encryption key must belong to the Google Cloud Service Account Key configured for your Atlas project. Click the Service Account Key section to view the currently configured Service Account Key for the project.

4. Click Update Credentials.

Atlas displays a banner in the Atlas console during the Key Identifier rotation process.

If the cluster uses Back Up Your Database Deployment, do not delete or disable the original Key Version Resource ID until you ensure that no snapshots used that key for encryption.