Cloud HSM Atlas
Parent: MongoDB Atlas on GCP · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-e97ebaff6742
↓ Facts as markdownall context files
Source-anchored research for Cloud HSM Atlas. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Comparisons and alternatives
- Cloud HSM documents an 8 KiB message-size limit and separate HSM quota usage. Atlas’s key-wrapping design means these operations concern encryption keys rather than whole database files. (medium confidence) (verified as of 2026-10-22) [source]
- Cloud HSM documentation limits user-provided plaintext/ciphertext plus additional authenticated data to 8 KiB, versus 64 KiB for software keys. This API message limit should not be interpreted as an Atlas document-size limit. (low confidence) (verified as of 2026-10-22) [source]
Facts and statements
- Google’s September 2022 encryption matrix explicitly lists MongoDB Atlas with Cloud KMS and CloudHSM support. MongoDB’s shared responsibility model also includes HSM-backed customer-managed keys. (high confidence) (verified as of 2022-09-16) [source]
- Cloud HSM exposes hardware-backed cryptographic operations through Cloud KMS. Google manages the HSM cluster, including scaling and patching. (high confidence) [source]
- Atlas uses the Google Cloud customer-managed key to wrap per-node MongoDB master keys; those master keys wrap per-database encryption keys used by WiredTiger. (low confidence) [source]
- For the documented integration, create a symmetric encrypt/decrypt key with HSM protection in Cloud KMS, then supply its fully qualified CryptoKeyVersion resource name to Atlas and grant the Atlas identity the required key permissions. (medium confidence) [source]
- The Atlas Google Cloud KMS guide requires M10 or larger clusters, Project Owner access, project-level configuration, and subsequent enablement on each target cluster; Free and Flex clusters are excluded. (low confidence) (verified as of 2026-10-14) [source]
- Atlas does not automatically rotate its configured Google Cloud Key Version Resource ID. Update Atlas after key rotation, and retain the old version until changes deploy and no retained snapshot needs it. (low confidence) (verified as of 2026-10-14) [source]
- MongoDB warns that revoking Atlas access to its customer-managed key shuts down cluster nodes and makes data inaccessible until key access is restored. (low confidence) [source]
- Treat key storage, least-privilege access, rotation, and recovery as operational responsibilities. Percona recommends dedicated KMS or HSM storage and key lifecycle controls; MongoDB assigns customer-managed key configuration and access policies to customers. (high confidence) [source]
- Google describes Cloud HSM as a managed cluster of FIPS 140-2 Level 3 certified HSMs; Google manages clustering, scaling and patching. This certification statement concerns the HSM service, not a certification of an entire Atlas deployment. (high confidence) (verified as of 2026-10-22) [source]
- Atlas requires an M10-or-larger cluster, a symmetric KMS key and its fully qualified CryptoKeyVersion resource ID. Configure customer key management for the project, then enable it on each intended cluster. (low confidence) (verified as of 2026-10-23) [source]
- Revoking Atlas access to its customer-managed key can shut down cluster nodes. Keep the original key version enabled until rotation deploys and no retained backup snapshot needs it. (low confidence) [source]
- Google documents creation of a symmetric HSM key with gcloud kms keys create, --purpose encryption and --protection-level hsm; Atlas separately requires the resulting key-version resource identifier. (medium confidence) (verified as of 2026-10-23) [source]
Children
- HSM-backed customer-managed keys (frontier)
- Atlas CryptoKeyVersion lifecycle (frontier)
- Hardware key protection and envelope encryption (frontier)
Frontier under this node: Atlas CryptoKeyVersion lifecycle, HSM-backed customer-managed keys, Hardware key protection and envelope encryption