Running MongoDB securely on AWS using field-level encryption
summary
Client-side field-level encryption is built into MongoDB drivers and available on Atlas, encrypting selected fields on the application before anything reaches the server so DBAs and cloud operators only ever see ciphertext. It uses envelope encryption with AWS KMS/IAM, stores encrypted data keys in a key vault collection, supports deterministic and randomized encryption to allow indexed equality queries, targets MongoDB 4.2 with Java/Node/C#/Go/Python drivers, and adds only millisecond-level overhead in typical workloads.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 8:45Database Security Model
- 16:32Difficulty with encryption
- 18:15What does this mean
- 20:37Where does it run
- 22:35Tradeoffs
- 24:05Use cases
- 25:39Key building blocks
- 27:08Policies
- 28:13Service ID
- 30:22IAM Policies
- 30:50Cryptography
- 33:19What does it mean
- 34:59Performance
- 37:56Roadmap
related talks
51mClient-Side Field-Level Encryption for Apache Kafka Connect
42mHow AWS and MongoDB raise the security bar with distributed ownership
33mKey Management for Data-at-Rest Encryption in Percona Server for MongoDB
54mEnabling Message Level Protection at Uber
18mLessons learned from production confidential computing customer deployments
40mThe rise of the developer data platform
28mMongoDB in AWS (MongoDB as a DBaaS)
47mData at Rest Encryption Going Beyond the Basics to Address Modern Attacks