Description
DocumentDB encrypts stored data when using an AWS managed key. A customer managed KMS key is needed when you must control the key policy and lifecycle yourself.
Potential impact
An AWS managed key does not let you directly control its policy or deletion schedule, which may conflict with organizational key-management requirements.
Remediation
When that control is required, set kms_key_id to a customer managed key ARN. An existing encrypted cluster’s key cannot be changed in place; plan to copy its snapshot with the new key and restore a new cluster.
Examples
These excerpts show cluster encryption settings. alias/myAlias must refer to an actual customer managed key.
Before
hcl
data "aws_kms_key" "example" {
key_id = "alias/aws/rds"
}
resource "aws_docdb_cluster" "example" {
cluster_identifier = "my-docdb-cluster-test2"
engine = "docdb"
storage_encrypted = true
kms_key_id = data.aws_kms_key.example.arn
}
After
hcl
data "aws_kms_key" "example" {
key_id = "alias/myAlias"
}
resource "aws_docdb_cluster" "example" {
cluster_identifier = "my-docdb-cluster-test2"
engine = "docdb"
storage_encrypted = true
kms_key_id = data.aws_kms_key.example.arn
}