Atlas Envelope Encryption GCP
Parent: MongoDB Atlas on GCP · Published reference · snapshot 2026-10-24 · skill mongodb-cohort-2030af7213e7
↓ Facts as markdownall context files
Source-anchored research for Atlas Envelope Encryption GCP. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- Invalid KMS credentials or a deleted or disabled key cause Atlas to stop mongod and mongos at the next validity check. Checks run every 15 minutes and on credential changes; inability to connect to KMS alone does not trigger this shutdown. (low confidence) (verified as of 2026-10-24) [source]
How-to and procedures
- Configure customer key management for the Atlas project, then enable it separately on each intended cluster; project configuration alone does not enable every cluster. (high confidence) (verified as of 2026-10-23) [source]
Problems, failure modes and limitations
- Atlas distinguishes confirmed invalid credentials or disabled/deleted keys from KMS connectivity failures: it shuts down database processes after detecting invalid settings, but leaves running processes up when KMS cannot be reached. (low confidence) (verified as of 2026-10-14) [source]
Facts and statements
- Atlas uses the GCP customer-managed key to wrap each node’s MongoDB Master Key, which wraps per-database keys used by WiredTiger; this instantiates Google’s general envelope-encryption model. (high confidence) [source]
- Cloud KMS envelope encryption separates bulk data encryption from key wrapping: workloads encrypt data locally and KMS protects wrapping keys, which remain inside KMS. (high confidence) [source]
- Atlas customer key management requires M10 or larger clusters; Free and Flex clusters are excluded. (medium confidence) (verified as of 2026-10-23) [source]
- Atlas recommends its project-specific managed service account for GCP KMS authentication and also documents static credentials. Migration from static credentials to service-account authentication is one-way. (low confidence) (verified as of 2026-10-23) [source]
- The Atlas-managed service account needs roles/cloudkms.cryptoKeyEncrypterDecrypter and roles/cloudkms.viewer on the KMS key; both the Atlas setup guide and maintained GCP Terraform module specify these roles. (high confidence) (verified as of 2026-10-23) [source]
- Atlas rotates MongoDB Master Keys on a nominal 90-day cadence, but deferred maintenance can delay rotation; rotation does not require rewriting data. (low confidence) (verified as of 2026-10-23) [source]
- Google automatic key rotation does not alone update Atlas’s configured key-version identifier: Atlas documents an explicit identifier update, and the maintained module documents a Terraform plan change on the next apply after rotation. (medium confidence) (verified as of 2026-10-23) [source]
- Keep the original GCP key version enabled until Atlas deploys its replacement and no retained snapshot depends on the original version. (low confidence) (verified as of 2026-10-23) [source]
- Atlas documents KMS validation at credential changes, every 15 minutes, and on demand; key revocation should not be described as an instantaneous shutdown guarantee. (low confidence) (verified as of 2026-10-14) [source]
- A March 2024 HashiCorp Discuss report records MISSING_ENCRYPTION_AT_REST_PROVIDER during GCP KMS Terraform setup despite successful UI setup; an April respondent reported success with provider 1.15.3 or newer and a heredoc JSON credential. This is historical anecdotal evidence, not a verified current workaround. (low confidence) [source]
- The MongoDB-maintained GCP Terraform module supports either an existing KMS key-version resource ID or creation of a key ring and crypto key; it manages Atlas cloud-provider access and required key IAM bindings. (medium confidence) (verified as of 2026-10-23) [source]
- Database customer-key encryption does not automatically cover co-located search indexes; Atlas documents dedicated Search Nodes and Search Node Data Encryption as the way to cover those indexes with customer-managed keys. (medium confidence) (verified as of 2026-10-14) [source]
- Envelope encryption protects encryption keys with another key. Google describes wrapping a locally generated data key with a KMS key; NIST describes key wrapping as protecting cryptographic-key confidentiality and integrity. (high confidence) [source]
- Atlas targets MongoDB Master Key rotation every 90 days, with maintenance deferrals potentially extending the interval. Atlas does not automatically change the configured GCP Key Version Resource ID. (low confidence) (verified as of 2026-10-23) [source]
- NIST SP 800-38F specifies AES KW and KWP key-wrapping modes. Its scope establishes a key-protection primitive; it does not establish which wrapping mode Atlas or Google KMS uses. (low confidence) [source]
Children
- No children recorded.