Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Unable to Encrypt Amazon DocumentDB Elastic Cluster

0

We have an Amazon DocumentDB Elastic Cluster created without encryption. Now, we need to enable encryption at rest.

**Following the standard procedure, we: ** Created a snapshot of the unencrypted cluster. Copied the snapshot, selecting the encryption option and specifying a KMS key. Restored the encrypted snapshot into a new cluster. However, this did not work—the copied snapshot was still not encrypted.

**Troubleshooting Attempts: Verified encryption settings while copying the snapshot. Try to Check AWS CLI output for StorageEncrypted:, but I get empty response using the command mentioned in the documentation. Tried different KMS keys (default AWS-managed and custom). Successfully encrypted a DocumentDB Instance-based cluster, but the same process does not work for Elastic Cluster. **Issue: **We are unable to encrypt an existing DocumentDB Elastic Cluster following the snapshot-copy-restore method.

**Question: **Is there a different approach to enable encryption on an existing DocumentDB Elastic Cluster? If not, what is the recommended way to migrate an unencrypted DocumentDB Elastic Cluster to an encrypted one without data loss?

Topics
Security, Identity, & ComplianceDatabase
Tags
EncryptionAWS Key Management ServiceAmazon DocumentDB
Language
English
asked 9 months ago91 views
1 Answer
0

For Amazon DocumentDB clusters, as you correctly mentioned encryption at rest can only be enabled at the time of cluster creation and cannot be modified afterwards. However, you can migrate your unencrypted cluster to an encrypted one using the following approach:

Migration Process

  1. Create a new Amazon DocumentDB Elastic Cluster with encryption enabled
  2. Use AWS Database Migration Service (DMS) to migrate data from your unencrypted cluster to the new encrypted cluster.

Hope this helps. Thanks!

AWS
answered 9 months ago
  • divyesh
    9 months ago

    I already tried it, but when I created the cluster with encryption enabled, it actually didn't have the encryption enabled in the database encryption status. I'm not sure. Is it a glitch or something else?!!

  • Vardan Matevosyan
    9 months ago

    Are you using Console or CLI? Clusters that you create using the console have encryption at rest enabled by default. Clusters that you create using the AWS CLI have encryption at rest disabled by default. Therefore, you must explicitly enable encryption at rest using the --storage-encrypted parameter. Also, please ensure you're using a symmetric encryption KMS key, as Amazon DocumentDB does not support asymmetric KMS keys. If you've followed these steps correctly and still don't see encryption enabled, you should Verify your IAM permissions include access to the KMS key. If none of this helps, contact AWS Support as this might be unexpected behavior. Thanks!

  • divyesh
    8 months ago

    Thanks for the response, Actually, I followed the AWS documentation, which describes the same what you mentioned. so I considered all this points while creating the DB cluster, I've created this database from the console, but the thing is, I don't see "Yes" in the Encrypted column or anywhere in the description that ensures that the database is encrypted. How can I ensure that this database is encrypted now?

  • Vardan Matevosyan
    8 months ago

    Thank you for confirming. Can you please try to verify the encryption details using the following AWS CLI command: aws docdb-elastic describe-cluster In the output we are looking for the "StorageEncrypted" field to see if its true or false. If its false, that means its not encrypted, and since you have done from Console, it should have been encrypted. This means something went wrong during the cluster creation process. I would recommend trying again to create a new cluster. https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-view-details.html

  • Vardan Matevosyan
    8 months ago

    Hello, If the answer was satisfactory to you please consider marking it as accepted. Thanks!

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content