Skip to content

Commit 9fd394e

Browse files
maasthamaastha
authored
doc: Add example & documentation for mongodbatlas_encryption_at_rest_private_endpoint to specify AWS usage (#2999)
1 parent fd0f885 commit 9fd394e

20 files changed

+301
-40
lines changed

‎docs/data-sources/encryption_at_rest.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ output "is_azure_encryption_at_rest_valid" {
101101
}
102102
```
103103

104-
-> **NOTE:** It is possible to configure Atlas Encryption at Rest to communicate with Azure Key Vault using Azure Private Link, ensuring that all traffic between Atlas and Key Vault takes place over Azure’s private network interfaces. Please review `mongodbatlas_encryption_at_rest_private_endpoint` resource for details.
104+
-> **NOTE:** It is possible to configure Atlas Encryption at Rest to communicate with Customer Managed Keys (Azure Key Vault or AWS KMS) over private network interfaces (Azure Private Link or AWS PrivateLink). This requires enabling the `azure_key_vault_config.require_private_networking` or the `aws_kms_config.require_private_networking` attribute, together with the configuration of the `mongodbatlas_encryption_at_rest_private_endpoint` resource. Please review the `mongodbatlas_encryption_at_rest_private_endpoint` resource for details.
105105

106106
### Configuring encryption at rest using customer key management in GCP
107107
```terraform

‎docs/data-sources/encryption_at_rest_private_endpoint.md‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22

33
`mongodbatlas_encryption_at_rest_private_endpoint` describes a private endpoint used for encryption at rest using customer-managed keys.
44

5-
~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
6-
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
7-
85
## Example Usages
96

10-
-> **NOTE:** Only Azure Key Vault with Azure Private Link is supported at this time.
7+
-> **NOTE:** Only Azure Key Vault with Azure Private Link and AWS KMS over AWS PrivateLink is supported at this time.
8+
9+
### Encryption At Rest Azure Key Vault Private Endpoint
10+
To learn more, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
1111

1212
```terraform
1313
data "mongodbatlas_encryption_at_rest_private_endpoint" "single" {
@@ -21,6 +21,19 @@ output "endpoint_connection_name" {
2121
}
2222
```
2323

24+
### Encryption At Rest AWS KMS Private Endpoint
25+
```terraform
26+
data "mongodbatlas_encryption_at_rest_private_endpoint" "single" {
27+
project_id = var.atlas_project_id
28+
cloud_provider = "AWS"
29+
id = mongodbatlas_encryption_at_rest_private_endpoint.endpoint.id
30+
}
31+
32+
output "status" {
33+
value = data.mongodbatlas_encryption_at_rest_private_endpoint.single.status
34+
}
35+
```
36+
2437
<!-- schema generated by tfplugindocs -->
2538
## Schema
2639

‎docs/data-sources/encryption_at_rest_private_endpoints.md‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22

33
`mongodbatlas_encryption_at_rest_private_endpoints` describes private endpoints of a particular cloud provider used for encryption at rest using customer-managed keys.
44

5-
~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
6-
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
7-
85
## Example Usages
96

10-
-> **NOTE:** Only Azure Key Vault with Azure Private Link is supported at this time.
7+
-> **NOTE:** Only Azure Key Vault with Azure Private Link and AWS KMS over AWS PrivateLink is supported at this time.
8+
9+
### Encryption At Rest Azure Key Vault Private Endpoint
10+
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
1111

1212
```terraform
1313
data "mongodbatlas_encryption_at_rest_private_endpoints" "plural" {
@@ -20,6 +20,18 @@ output "number_of_endpoints" {
2020
}
2121
```
2222

23+
### Encryption At Rest AWS KMS Private Endpoint
24+
```terraform
25+
data "mongodbatlas_encryption_at_rest_private_endpoints" "plural" {
26+
project_id = var.atlas_project_id
27+
cloud_provider = "AWS"
28+
}
29+
30+
output "number_of_endpoints" {
31+
value = length(data.mongodbatlas_encryption_at_rest_private_endpoints.plural.results)
32+
}
33+
```
34+
2335
<!-- schema generated by tfplugindocs -->
2436
## Schema
2537

‎docs/resources/encryption_at_rest.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,9 +126,9 @@ output "is_azure_encryption_at_rest_valid" {
126126
```
127127

128128
#### Manage Customer Keys with Azure Key Vault Over Private Endpoints
129-
It is possible to configure Atlas Encryption at Rest to communicate with Azure Key Vault using Azure Private Link, ensuring that all traffic between Atlas and Key Vault takes place over Azure’s private network interfaces. This requires enabling `azure_key_vault_config.require_private_networking` attribute, together with the configuration of `mongodbatlas_encryption_at_rest_private_endpoint` resource.
129+
It is possible to configure Atlas Encryption at Rest to communicate with Customer Managed Keys (Azure Key Vault or AWS KMS) over private network interfaces (Azure Private Link or AWS PrivateLink). This requires enabling the `azure_key_vault_config.require_private_networking` or the `aws_kms_config.require_private_networking` attribute, together with the configuration of the `mongodbatlas_encryption_at_rest_private_endpoint` resource.
130130

131-
Please review [`mongodbatlas_encryption_at_rest_private_endpoint` resource documentation](encryption_at_rest_private_endpoint) and [complete example](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/master/examples/mongodbatlas_encryption_at_rest_private_endpoint/azure) for details on this functionality.
131+
Please review the [`mongodbatlas_encryption_at_rest_private_endpoint` resource documentation](encryption_at_rest_private_endpoint) and [complete the example](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/master/examples/mongodbatlas_encryption_at_rest_private_endpoint/) for details on this functionality.
132132

133133

134134
### Configuring encryption at rest using customer key management in GCP

‎docs/resources/encryption_at_rest_private_endpoint.md‎

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,16 @@
22

33
`mongodbatlas_encryption_at_rest_private_endpoint` provides a resource for managing a private endpoint used for encryption at rest with customer-managed keys. This ensures all traffic between Atlas and customer key management systems take place over private network interfaces.
44

5-
~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.
6-
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
7-
8-
-> **NOTE:** As a prerequisite to configuring a private endpoint for Azure Key Vault, the corresponding [`mongodbatlas_encryption_at_rest`](encryption_at_rest) resource has to be adjust by configuring [`azure_key_vault_config.require_private_networking`](encryption_at_rest#require_private_networking) to true. This attribute should be updated in place, ensuring the customer-managed keys encryption is never disabled.
5+
-> **NOTE:** As a prerequisite to configuring a private endpoint for Azure Key Vault or AWS KMS, the corresponding [`mongodbatlas_encryption_at_rest`](encryption_at_rest) resource has to be adjusted by configuring to true [`azure_key_vault_config.require_private_networking`](encryption_at_rest#require_private_networking) or [`aws_kms_config.require_private_networking`](encryption_at_rest#require_private_networking), respectively. This attribute should be updated in place, ensuring the customer-managed keys encryption is never disabled.
96

107
-> **NOTE:** This resource does not support update operations. To modify values of a private endpoint the existing resource must be deleted and a new one can be created with the modified values.
118

129
## Example Usages
1310

14-
-> **NOTE:** Only Azure Key Vault with Azure Private Link is supported at this time.
11+
-> **NOTE:** Only Azure Key Vault with Azure Private Link and AWS KMS over AWS PrivateLink is supported at this time.
1512

1613
### Configuring Atlas Encryption at Rest using Azure Key Vault with Azure Private Link
14+
To learn more about existing limitations, see [Manage Customer Keys with Azure Key Vault Over Private Endpoints](https://www.mongodb.com/docs/atlas/security/azure-kms-over-private-endpoint/#manage-customer-keys-with-azure-key-vault-over-private-endpoints).
1715

1816
Make sure to reference the [complete example section](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/master/examples/mongodbatlas_encryption_at_rest_private_endpoint/azure) for detailed steps and considerations.
1917

@@ -66,6 +64,32 @@ resource "azapi_update_resource" "approval" {
6664
}
6765
```
6866

67+
### Configuring Atlas Encryption at Rest using AWS KMS with AWS PrivateLink
68+
69+
Make sure to reference the [complete example section](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/master/examples/mongodbatlas_encryption_at_rest_private_endpoint/aws) for detailed steps and considerations.
70+
71+
```terraform
72+
resource "mongodbatlas_encryption_at_rest" "ear" {
73+
project_id = var.atlas_project_id
74+
75+
aws_kms_config {
76+
require_private_networking = true
77+
78+
enabled = true
79+
customer_master_key_id = var.aws_kms_key_id
80+
region = var.atlas_aws_region
81+
role_id = mongodbatlas_cloud_provider_access_authorization.auth_role.role_id
82+
}
83+
}
84+
85+
# Creates private endpoint
86+
resource "mongodbatlas_encryption_at_rest_private_endpoint" "endpoint" {
87+
project_id = mongodbatlas_encryption_at_rest.ear.project_id
88+
cloud_provider = "AWS"
89+
region_name = var.atlas_aws_region
90+
}
91+
```
92+
6993
<!-- schema generated by tfplugindocs -->
7094
## Schema
7195

@@ -87,6 +111,7 @@ Encryption At Rest Private Endpoint resource can be imported using the project I
87111

88112
```
89113
$ terraform import mongodbatlas_encryption_at_rest_private_endpoint.test 650972848269185c55f40ca1-AZURE-650972848269185c55f40ca2
114+
$ terraform import mongodbatlas_encryption_at_rest_private_endpoint.test 650972848269185c55f40ca2-AWS-650972848269185c55f40ca3
90115
```
91116

92117
For more information see:

‎examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/README.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# MongoDB Atlas Provider - Encryption At Rest using Customer Key Management via Private Network Interfaces (AWS)
2+
This example shows how to configure encryption at rest using AWS with customer managed keys ensuring all communication with AWS Key Management Service (KMS) happens exclusively over AWS PrivateLink.
3+
4+
## Dependencies
5+
6+
* Terraform MongoDB Atlas Provider v1.27.0 minimum
7+
* A MongoDB Atlas account
8+
* Terraform AWS provider
9+
* An AWS account
10+
11+
## Usage
12+
13+
**1\. Provide the appropriate values for the input variables.**
14+
15+
- `atlas_public_key`: The public API key for MongoDB Atlas
16+
- `atlas_private_key`: The private API key for MongoDB Atlas
17+
- `atlas_project_id`: Atlas Project ID
18+
- `aws_kms_key_id`: ARN that identifies the Amazon Web Services (AWS) Customer Master Key (CMK) to use to encrypt and decrypt
19+
- `atlas_aws_region`: Region in which the Encryption At Rest private endpoint is located
20+
21+
**2\. Review the Terraform plan.**
22+
23+
Execute the following command and ensure you are happy with the plan.
24+
25+
``` bash
26+
$ terraform plan
27+
```
28+
This project will execute the following changes to acheive successful encryption at rest over AWS PrivateLink for customer managed keys:
29+
30+
- Configure encryption at rest in an existing project using a custom AWS KMS Key. For successful private networking configuration, the `requires_private_networking` attribute in `mongodbatlas_encryption_at_rest.aws_kms_config` is set to `true`.
31+
- Create a private endpoint for the existing project under a certain AWS region using `mongodbatlas_encryption_at_rest_private_endpoint`.
32+
33+
**3\. Execute the Terraform apply.**
34+
35+
Now execute the plan to provision the resources.
36+
37+
``` bash
38+
$ terraform apply
39+
```
40+
41+
**4\. Destroy the resources.**
42+
43+
When you have finished your testing, ensure you destroy the resources to avoid unnecessary |service| charges.
44+
45+
``` bash
46+
$ terraform destroy
47+
```
48+

‎examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/atlas-cloud-provider-access.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
resource "mongodbatlas_cloud_provider_access_setup" "setup_only" {
2+
project_id = var.atlas_project_id
3+
provider_name = "AWS"
4+
}
5+
6+
resource "mongodbatlas_cloud_provider_access_authorization" "auth_role" {
7+
project_id = var.atlas_project_id
8+
role_id = mongodbatlas_cloud_provider_access_setup.setup_only.role_id
9+
10+
aws {
11+
iam_assumed_role_arn = aws_iam_role.test_role.arn
12+
}
13+
}

‎examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/aws-roles.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
resource "aws_iam_role_policy" "test_policy" {
2+
name = "mongodb-atlas-kms-policy"
3+
role = aws_iam_role.test_role.id
4+
5+
policy = <<-EOF
6+
{
7+
"Version": "2012-10-17",
8+
"Statement": [
9+
{
10+
"Effect": "Allow",
11+
"Action": [
12+
"kms:Decrypt",
13+
"kms:Encrypt",
14+
"kms:DescribeKey"
15+
],
16+
"Resource": [
17+
"${var.aws_kms_key_id}"
18+
]
19+
}
20+
]
21+
}
22+
EOF
23+
}
24+
25+
resource "aws_iam_role" "test_role" {
26+
name = "mongodb-atlas-kms-role"
27+
28+
assume_role_policy = <<EOF
29+
{
30+
"Version": "2012-10-17",
31+
"Statement": [
32+
{
33+
"Effect": "Allow",
34+
"Principal": {
35+
"AWS": "${mongodbatlas_cloud_provider_access_setup.setup_only.aws_config[0].atlas_aws_account_arn}"
36+
},
37+
"Action": "sts:AssumeRole",
38+
"Condition": {
39+
"StringEquals": {
40+
"sts:ExternalId": "${mongodbatlas_cloud_provider_access_setup.setup_only.aws_config[0].atlas_assumed_role_external_id}"
41+
}
42+
}
43+
}
44+
]
45+
}
46+
EOF
47+
}

‎examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/main.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "mongodbatlas_encryption_at_rest" "ear" {
2+
project_id = var.atlas_project_id
3+
4+
aws_kms_config {
5+
require_private_networking = true
6+
7+
enabled = true
8+
customer_master_key_id = var.aws_kms_key_id
9+
region = var.atlas_aws_region
10+
role_id = mongodbatlas_cloud_provider_access_authorization.auth_role.role_id
11+
}
12+
}
13+
14+
# Creates private endpoint
15+
resource "mongodbatlas_encryption_at_rest_private_endpoint" "endpoint" {
16+
project_id = mongodbatlas_encryption_at_rest.ear.project_id
17+
cloud_provider = "AWS"
18+
region_name = var.atlas_aws_region
19+
}

‎examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/plural-data-source.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
data "mongodbatlas_encryption_at_rest_private_endpoints" "plural" {
2+
project_id = var.atlas_project_id
3+
cloud_provider = "AWS"
4+
}
5+
6+
output "number_of_endpoints" {
7+
value = length(data.mongodbatlas_encryption_at_rest_private_endpoints.plural.results)
8+
}

0 commit comments

Comments
 (0)