Key management service

As explained in MongoDB 8.0 in Action, Third Edition

Encryption key management is the administration and controlled use of cryptographic keys for encrypting and decrypting protected data.

A key management service (KMS) administers and controls cryptographic keys used to encrypt and decrypt protected data. In Atlas, enabling KMS integration is part of the customer’s initial security configuration, alongside Bring Your Own Key (BYOK), identity management, network connectivity, auditing, and backup settings. section 20.1

Use KMS with awareness of the shared operational boundary:

• Configure the encryption integration and select the relevant cloud-provider security settings during initial deployment. section 20.1
• Treat ongoing enforcement as a platform responsibility: Atlas maintains encryption at rest and in transit, authentication, network isolation, auditing, and backups after setup. section 20.1
• Retain the required customer-managed key and IAM credentials when restoring managed backup snapshots; KMS integration makes them necessary for restores. section 21.1.1

KMS-backed backup restore

Atlas managed snapshots are encrypted automatically. When integration with AWS KMS, Azure Key Vault, or GCP KMS is enabled, restoring a snapshot requires the corresponding customer-managed key or service-account key and IAM credentials. section 21.1.1

Figure 20.1 The shared responsibility model in Atlas divides security and operational tasks among customers, MongoDB, and the underlying cloud providers (AWS, GCP, and Azure). (Image © MongoDB 2024 CC BY-NC-SA 3.0)

Use the shared responsibility model to distinguish customer configuration of KMS and BYOK from Atlas’s continuing enforcement of encryption and other security controls. section 20.1

How MongoDB 8.0 in Action, Third Edition covers it

How deep it goes

Explains configuration ownership and restore dependencies, but does not detail key-generation, rotation, or provider-specific procedures.

Examples

Uses Atlas managed snapshots restored with provider-specific customer keys and IAM credentials.

What you can do after

Configure Atlas encryption-key integration and preserve the credentials required to restore encrypted backup snapshots.

How it connects

Connects KMS with BYOK, encryption at rest, IAM, backups, data residency, and the shared responsibility model.

liveBookmanning.com

Read MongoDB 8.0 in Action, Third Edition on liveBook Get the book at manning.com

Related concepts

• encryptionused by · Encryption is the cryptographic transformation of readable data into ciphertext to conceal its contents, reversible through decryption with appropriate information.
• cryptographic keyuses · A cryptographic key is a value supplied to a cryptographic algorithm to control operations such as encryption, decryption, signing, authentication, or verification.
• hardware security modulehas part · A hardware security module is a tamper-resistant device that generates, stores, and uses cryptographic keys while protecting them from unauthorized extraction.
• key managementused by · Key management is the lifecycle administration of cryptographic keys, including their generation, storage, protection, distribution, use, rotation, revocation, and retirement.
• encryption at restconfigures · Encryption at rest is the protection of stored data by encrypting it so it cannot be read without the appropriate cryptographic key.

This explainer was generated by Manning's knowledge graph from the text of MongoDB 8.0 in Action, Third Edition. The section links point to the parts of the book it draws on.