Check ID: clusters_encryption_at_rest_enabled
Provider: MongoDB Atlas
Service: clusters
Severity: CRITICAL
Categories: encryption
Resource type: NotDefined

​
What this check verifies

MongoDB Atlas clusters are evaluated for encryption at rest. The check looks for a supported encryption provider configured (not NONE) or storage-level encryption enabled (e.g., encryptEBSVolume=true). Unsupported providers or explicit disablement are highlighted.

​
Risk

Absent or misconfigured at-rest encryption allows disks and snapshots to be read if storage, backups, or images are accessed by attackers or insiders. This exposes sensitive records, erodes confidentiality, and enables quiet data exfiltration after host or control-plane compromise.

​
Recommendation

Enable encryption at rest with a supported provider and prefer customer-managed keys to control lifecycle and access. Apply least-privilege to key usage, restrict KMS connectivity, and monitor key health and rotation. If using AWS, also ensure volumes are encrypted. This enforces defense-in-depth and data confidentiality.

​
Remediation

# Enable project-level KMS
resource "mongodbatlas_encryption_at_rest" "<example_resource_name>" {
  project_id = "<example_resource_id>"
  aws_kms_config {
    enabled                = true  # critical: turns on KMS for the project so clusters can use it
    customer_master_key_id = "<KMS_KEY_ID>"
    region                 = "<AWS_REGION>"
    role_id                = "<ATLAS_AWS_ROLE_ID>"
  }
}

# Set the cluster to use a supported encryption provider
resource "mongodbatlas_advanced_cluster" "<example_resource_name>" {
  project_id                  = "<example_resource_id>"
  name                        = "<example_resource_name>"
  cluster_type                = "REPLICASET"
  encryption_at_rest_provider = "AWS"  # critical: enables encryption at rest with a supported provider

  replication_specs {
    region_configs {
      provider_name = "AWS"
      region_name   = "<AWS_REGION>"
      electable_specs {
        instance_size = "M10"
        node_count    = 3
      }
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = clusters_encryption_at_rest_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to MongoDB Atlas checks