Back to Checks
mongodbatlas

Cluster has encryption at rest enabled with a supported provider or EBS volume encryption

clusters_encryption_at_rest_enabled
Service: clustersSeverity: critical
OfficialBuilt-inVerified
Categories:encryption
Resource Type:NotDefined

MongoDB Atlas clusters are evaluated for encryption at rest. The check looks for a supported encryption provider configured (not NONE) or storage-level encryption enabled (e.g., encryptEBSVolume=true). Unsupported providers or explicit disablement are highlighted.

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Absent or misconfigured at-rest encryption allows disks and snapshots to be read if storage, backups, or images are accessed by attackers or insiders. This exposes sensitive records, erodes confidentiality, and enables quiet data exfiltration after host or control-plane compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks clusters_encryption_at_rest_enabled

Recommendation

Enable encryption at rest with a supported provider and prefer customer-managed keys to control lifecycle and access. Apply least-privilege to key usage, restrict KMS connectivity, and monitor key health and rotation. If using AWS, also ensure volumes are encrypted. This enforces defense-in-depth and data confidentiality.

Remediation

Terraform

# Enable project-level KMS
resource "mongodbatlas_encryption_at_rest" "<example_resource_name>" {
  project_id = "<example_resource_id>"
  aws_kms_config {
    enabled                = true  # critical: turns on KMS for the project so clusters can use it
    customer_master_key_id = "<KMS_KEY_ID>"
    region                 = "<AWS_REGION>"
    role_id                = "<ATLAS_AWS_ROLE_ID>"
  }
}

# Set the cluster to use a supported encryption provider
resource "mongodbatlas_advanced_cluster" "<example_resource_name>" {
  project_id                  = "<example_resource_id>"
  name                        = "<example_resource_name>"
  cluster_type                = "REPLICASET"
  encryption_at_rest_provider = "AWS"  # critical: enables encryption at rest with a supported provider

  replication_specs {
    region_configs {
      provider_name = "AWS"
      region_name   = "<AWS_REGION>"
      electable_specs {
        instance_size = "M10"
        node_count    = 3
      }
    }
  }
}

Other

1In Atlas, go to Security > Advanced
2Toggle "Encryption at Rest using your Key Management" to On and enter your provider details (AWS KMS/Azure Key Vault/GCP KMS)
3Save
4Go to Database > Clusters, open the menu for <example_resource_name> and click Edit Configuration
5Expand Additional Settings and set "Manage your own encryption keys" to Yes
6Review Changes > Apply Changes

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.config import ATLAS_ENCRYPTION_PROVIDERS
from prowler.providers.mongodbatlas.services.clusters.clusters_client import (
    clusters_client,
)


class clusters_encryption_at_rest_enabled(Check):
    """Check if MongoDB Atlas clusters have encryption at rest enabled

    This class verifies that MongoDB Atlas clusters have encryption at rest
    enabled to protect data stored on disk.
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas cluster encryption at rest check

        Iterates over all clusters and checks if they have encryption at rest
        enabled with a supported encryption provider.

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each cluster
        """
        findings = []

        for cluster in clusters_client.clusters.values():
            report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=cluster)

            if cluster.encryption_at_rest_provider:
                if cluster.encryption_at_rest_provider in ATLAS_ENCRYPTION_PROVIDERS:
                    if cluster.encryption_at_rest_provider == "NONE":
                        report.status = "FAIL"
                        report.status_extended = (
                            f"Cluster {cluster.name} in project {cluster.project_name} "
                            f"has encryption at rest explicitly disabled."
                        )
                    else:
                        report.status = "PASS"
                        report.status_extended = (
                            f"Cluster {cluster.name} in project {cluster.project_name} "
                            f"has encryption at rest enabled with provider: {cluster.encryption_at_rest_provider}."
                        )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Cluster {cluster.name} in project {cluster.project_name} "
                        f"has an unsupported encryption provider: {cluster.encryption_at_rest_provider}."
                    )
            else:
                # Check provider settings for EBS encryption (AWS specific)
                provider_settings = cluster.provider_settings or {}
                encrypt_ebs_volume = provider_settings.get("encryptEBSVolume", False)

                if encrypt_ebs_volume:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Cluster {cluster.name} in project {cluster.project_name} "
                        f"has EBS volume encryption enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Cluster {cluster.name} in project {cluster.project_name} "
                        f"does not have encryption at rest enabled."
                    )

            findings.append(report)

        return findings

References