# KMS Encryption at Rest > Depth-first rabbithole dossier for KMS Encryption at Rest; source-anchored research pack. Parent: [MongoDB Atlas AWS Networking](https://llms-explorer.com/tree/mongodb-atlas-aws-networking/) · 4 facets · 36 facts · page: https://llms-explorer.com/tree/kms-encryption-at-rest/ ## How it works - [low] Atlas sends an email to the Project Owner listing all affected clusters when clusters are disabled due to invalid Encryption at Rest settings. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] Atlas validates KMS configuration when credentials are added or updated and every 15 minutes. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] When key material for an imported key is deleted or expires, the state changes from Enabled to PendingImport. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] A KMS key in an AWS CloudHSM key store is Unavailable when the custom key store is intentionally disconnected from its AWS CloudHSM cluster. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] A KMS key in an external key store is Unavailable when the custom key store is intentionally disconnected from its external key store proxy. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] A multi-Region replica key is in the transient Creating state while being created, transitioning to Enabled or PendingImport when replication completes. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Multi-Region keys are in the transient Updating state while the primary Region is being updated, resuming the Enabled state when the update completes. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] When deletion of a multi-Region primary key with replicas is scheduled, it remains in PendingReplicaDeletion until all replica keys are deleted, then changes to PendingDeletion. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] DisabledException occurs when a key ARN is disabled or pending deletion (or pending replica deletion). Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] KMSInvalidStateException occurs when a key ARN is pending deletion (or pending replica deletion), not pending deletion (or pending replica deletion), pending import, unavailable, creating, or updating. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] UnsupportedOperationException occurs when a key ARN origin is EXTERNAL which is not valid for the operation. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` ## Problems, failure modes and limitations - [low] If your key was deleted, restore that key to regain access to your clusters, and you cannot change a key or disable Encryption at Rest using Customer Key Management without a valid key. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] If you switch your encryption keys to role-based access, you cannot undo the role-based access configuration and revert to credentials-based access for encryption keys on that project. Sources: https://www.mongodb.com/docs/atlas/security/aws-kms-over-private-endpoint.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#antipatterns` - [low] To change your KMS region, your AWS KMS key must be a multi-Region key, and you cannot convert a single-Region key to a multi-Region key. Sources: https://www.mongodb.com/docs/atlas/security-aws-kms.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] If Atlas cannot access an AWS KMS key, any data that the key encrypted becomes inaccessible. Sources: https://www.mongodb.com/docs/atlas/security/aws-kms-over-private-endpoint.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] For a KMS key in a custom key store, if the backing key is disabled or deleted, the KMS key state does not change, but cryptographic operations using the KMS key fail. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` ## Comparisons and alternatives - [low] If you use the AWS KMS key with an IAM role from a different AWS account than the one that created the key, you must provide the full ARN for the AWS KMS key instead of the master key ID in the AWS KMS key ID field. Sources: https://www.mongodb.com/docs/atlas/security/aws-kms-over-private-endpoint.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` ## Facts and statements - [low] Atlas supports Encryption at Rest using AWS KMS over private networking only for single-cloud deployments and projects in the ACTIVE state, requiring an M10 or larger cluster. Sources: https://www.mongodb.com/docs/atlas/security/aws-kms-over-private-endpoint.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Atlas uses the same IAM role and AWS KMS key settings for all clusters in a project for which Encryption at Rest is enabled. Sources: https://www.mongodb.com/docs/atlas/security/aws-kms-over-private-endpoint.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] The Encryption at Rest KMS network access denied alert is enabled by default for all new projects to communicate any KMS network issues. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] Atlas automatically rotates MongoDB Master Keys at least every 90 days, while it does not automatically rotate the AWS CMK used for AWS-provided Encryption at Rest. Sources: https://www.mongodb.com/docs/atlas/security-aws-kms.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Atlas implements role-based access control (RBAC) with encryption for data in transit and at rest. Sources: https://aws.amazon.com/marketplace/pp/prodview-pp445qepfdy34 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Database nodes use the WiredTiger Encrypted Storage Engine, while Search Nodes use encryption at the disk level. Sources: https://www.mongodb.com/docs/atlas/security-aws-kms.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Atlas uses the CMK only to encrypt MongoDB Master Keys, with each node in the cluster creating a MongoDB Master Key and an encryption key per database. Sources: https://www.mongodb.com/docs/atlas/security-aws-kms.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Atlas makes about one decrypt request per replica set member per hour during validation, generating about 500 more KMS requests for a standard three-node replica set with a seven-day validation window. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] In public preview, Atlas supports customer-managed keys on Atlas Infinite only through AWS KMS, and restores must occur within the project that created the snapshot. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Validation instances appear as extra principals in KMS audit logs, use the same customer-managed keys as cluster nodes, and may require IP allowlist updates if IP allowlists are used for KMS. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] AWS KMS typically allows access by IAM role, so no additional IP allowlist configuration is required for validation instances if the IAM policy permits the Atlas role. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] For multi-region AWS CMKs, every regional key ARN must be added to the KMS key policy so Atlas clusters in those regions can access it. Sources: https://www.mongodb.com/docs/atlas/security/aws-kms-over-private-endpoint.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] All KMS keys can be in Enabled, Disabled, and PendingDeletion states, with imported key material keys created in PendingImport state. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] The Creating, Updating, and PendingReplicaDeletion key states apply only to multi-Region keys. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] While a KMS key in a custom key store is pending deletion, its state remains PendingDeletion even if it becomes unavailable, which allows deletion to be canceled at any time during the waiting period. For an Unavailable key, EnableKey and DisableKey succeed but the key state does not change until the key becomes available. Sources: https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Atlas helps organizations protect sensitive data through native encryption, comprehensive compliance certifications, and industry-leading security controls. Sources: https://aws.amazon.com/marketplace/pp/prodview-pp445qepfdy34 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#core` - [low] Atlas shuts down all mongod and mongos processes on the next scheduled validity check if your key management provider credentials become invalid or someone deletes or disables your encryption key. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] If your KMS provider becomes unavailable, it does not disable your running cluster, but if you restart such a cluster, Atlas disables it if its key is revoked. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` - [low] Atlas processes changes once someone restores your encryption key, continues to perform maintenance and apply security patches, and disabled clusters retain all data so billing continues. Sources: https://www.mongodb.com/docs/atlas/security-kms-encryption.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/kms-encryption-at-rest-30016f5016/rabbithole-synthesis.md#troubleshooting` ## Related concepts - KMS — is a part of KMS Encryption at Rest - Encryption — is a part of KMS Encryption at Rest - Rest — is a part of KMS Encryption at Rest