doc: Add example & documentation for `mongodbatlas_encryption_at_rest_private_endpoint` to specify AWS usage #2999

maastha · 2025-01-23T22:24:25Z

Description

Add example & documentation for mongodbatlas_encryption_at_rest_private_endpoint to specify AWS usage

Link to any related issue(s): CLOUDP-296238

Type of change:

Bug fix (non-breaking change which fixes an issue). Please, add the "bug" label to the PR.
New feature (non-breaking change which adds functionality). Please, add the "enhancement" label to the PR. A migration guide must be created or updated if the new feature will go in a major version.
Breaking change (fix or feature that would cause existing functionality to not work as expected). Please, add the "breaking change" label to the PR. A migration guide must be created or updated.
This change requires a documentation update
Documentation fix/enhancement

Required Checklist:

I have signed the MongoDB CLA
I have read the contributing guides
I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
I have added tests that prove my fix is effective or that my feature works per HashiCorp requirements
I have added any necessary documentation (if appropriate)
I have run make fmt and formatted my code
If changes include deprecations or removals I have added appropriate changelog entries.
If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Further comments

maastha · 2025-01-23T23:01:27Z

templates/resources/encryption_at_rest_private_endpoint.md.tmpl

@@ -5,27 +5,34 @@
 ~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager. 


TODO: Awaiting response for correct messaging here from upstream

maastha · 2025-01-23T23:01:46Z

docs/resources/encryption_at_rest_private_endpoint.md

@@ -5,13 +5,13 @@
 ~> **IMPORTANT** The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager. 


TODO: Awaiting response for correct messaging here from upstream

maastha · 2025-01-23T23:01:58Z

examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/README.md

+
+**1\. Ensure that Encryption At Rest AWS KMS Private Endpoint feature is available for your project.**
+
+The Encryption at Rest using AWS KMS over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.


TODO: Awaiting response for correct messaging here from upstream

github-actions · 2025-01-23T23:13:19Z

APIx bot: a message has been sent to Docs Slack channel

AgustinBettati

LGTM

EspenAlbert · 2025-01-24T16:03:51Z

examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/plural-data-source.tf

@@ -0,0 +1,8 @@
+data "mongodbatlas_encryption_at_rest_private_endpoints" "plural" {


Why are the data-sources in separate files?

EspenAlbert · 2025-01-24T16:05:35Z

examples/mongodbatlas_encryption_at_rest_private_endpoint/aws/README.md

+This project will execute the following changes to acheive successful encryption at rest over AWS PrivateLink for customer managed keys:
+
+- Configure encryption at rest in an existing project using a custom AWS KMS Key. For successful private networking configuration, the `requires_private_networking` attribute in `mongodbatlas_encryption_at_rest.aws_kms_config` is set to `true`.
+- Create a private endpoint for the existing project under a certain AWS region using `mongodbatlas_encryption_at_rest_private_endpoint`. 


Cool that there is no requirement of creating any AWS resources other than IAM Role

EspenAlbert · 2025-01-24T16:06:51Z

templates/data-sources/encryption_at_rest.md.tmpl

@@ -22,7 +22,7 @@
 ### Configuring encryption at rest using customer key management in Azure
 {{ tffile (printf "examples/%s/azure/main.tf" .Name )}}

-> **NOTE:** It is possible to configure Atlas Encryption at Rest to communicate with Azure Key Vault using Azure Private Link, ensuring that all traffic between Atlas and Key Vault takes place over Azure’s private network interfaces. Please review `mongodbatlas_encryption_at_rest_private_endpoint` resource for details.
+-> **NOTE:** It is possible to configure Atlas Encryption at Rest to communicate with Customer Managed Keys (Azure Key Vault or AWS KMS) over private network interfaces (Azure Private Link or AWS PrivateLinK). This requires enabling `azure_key_vault_config.require_private_networking` or `aws_kms_config.require_private_networking` attribute, together with the configuration of `mongodbatlas_encryption_at_rest_private_endpoint` resource. Please review `mongodbatlas_encryption_at_rest_private_endpoint` resource for details.


typo: PrivateLinK

EspenAlbert · 2025-01-24T16:08:22Z

templates/data-sources/encryption_at_rest_private_endpoint.md.tmpl


 {{ tffile (printf "examples/%s/azure/singular-data-source.tf" .Name )}}

+### Encryption At Rest AWS KMS Private Endpoint
+{{ tffile (printf "examples/%s/aws/singular-data-source.tf" .Name )}}


aha. I see the usage of separate files for data sources now 😅.
Would be cool if we had a custom directive tffile_resource so we don't need separate files in the examples

EspenAlbert · 2025-01-24T16:08:50Z

templates/resources/encryption_at_rest.md.tmpl

@@ -47,9 +47,9 @@ resource "mongodbatlas_encryption_at_rest" "default" {
 {{ tffile (printf "examples/%s/azure/main.tf" .Name )}}

 #### Manage Customer Keys with Azure Key Vault Over Private Endpoints
-It is possible to configure Atlas Encryption at Rest to communicate with Azure Key Vault using Azure Private Link, ensuring that all traffic between Atlas and Key Vault takes place over Azure’s private network interfaces. This requires enabling `azure_key_vault_config.require_private_networking` attribute, together with the configuration of `mongodbatlas_encryption_at_rest_private_endpoint` resource. 
+It is possible to configure Atlas Encryption at Rest to communicate with Customer Managed Keys (Azure Key Vault or AWS KMS) over private network interfaces (Azure Private Link or AWS PrivateLinK). This requires enabling `azure_key_vault_config.require_private_networking` or `aws_kms_config.require_private_networking` attribute, together with the configuration of `mongodbatlas_encryption_at_rest_private_endpoint` resource. 


same typo: uppercase K

EspenAlbert

LGTM

maastha added 11 commits January 22, 2025 16:26

add ear pe tests AWS

c73ad0c

unit test

60b2d4e

cleanup

507dccc

minor

fad13f4

minor

a4aa1bf

minor

f23fbcb

min

515a67c

docs and examples

5a1a966

ear

91d08ed

tflint

0cf369c

min

4cb909c

maastha commented Jan 23, 2025

View reviewed changes

maastha marked this pull request as ready for review January 23, 2025 23:12

maastha requested review from a team as code owners January 23, 2025 23:12

marcosuma approved these changes Jan 24, 2025

View reviewed changes

lantoli approved these changes Jan 24, 2025

View reviewed changes

AgustinBettati approved these changes Jan 24, 2025

View reviewed changes

Base automatically changed from CLOUDP-295878-ear-pe to CLOUDP-262752-ear-aws-kms-dev January 24, 2025 11:32

update availability message

e969a12

EspenAlbert reviewed Jan 24, 2025

View reviewed changes

EspenAlbert approved these changes Jan 24, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

doc: Add example & documentation for `mongodbatlas_encryption_at_rest_private_endpoint` to specify AWS usage #2999

doc: Add example & documentation for `mongodbatlas_encryption_at_rest_private_endpoint` to specify AWS usage #2999

maastha commented Jan 23, 2025 •

edited

Loading

maastha Jan 23, 2025 •

edited

Loading

maastha Jan 23, 2025 •

edited

Loading

maastha Jan 23, 2025 •

edited

Loading

github-actions bot commented Jan 23, 2025

AgustinBettati left a comment

EspenAlbert Jan 24, 2025

EspenAlbert Jan 24, 2025

EspenAlbert Jan 24, 2025

EspenAlbert Jan 24, 2025

EspenAlbert Jan 24, 2025

EspenAlbert left a comment

		@@ -5,27 +5,34 @@
		~> IMPORTANT The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.

		@@ -5,13 +5,13 @@
		~> IMPORTANT The Encryption at Rest using Azure Key Vault over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.


		1\. Ensure that Encryption At Rest AWS KMS Private Endpoint feature is available for your project.

		The Encryption at Rest using AWS KMS over Private Endpoints feature is available by request. To request this functionality for your Atlas deployments, contact your Account Manager.

		@@ -0,0 +1,8 @@
		data "mongodbatlas_encryption_at_rest_private_endpoints" "plural" {

doc: Add example & documentation for mongodbatlas_encryption_at_rest_private_endpoint to specify AWS usage #2999

Are you sure you want to change the base?

doc: Add example & documentation for mongodbatlas_encryption_at_rest_private_endpoint to specify AWS usage #2999

Conversation

maastha commented Jan 23, 2025 • edited Loading

Description

Type of change:

Required Checklist:

Further comments

maastha Jan 23, 2025 • edited Loading

Choose a reason for hiding this comment

maastha Jan 23, 2025 • edited Loading

Choose a reason for hiding this comment

maastha Jan 23, 2025 • edited Loading

Choose a reason for hiding this comment

github-actions bot commented Jan 23, 2025

AgustinBettati left a comment

Choose a reason for hiding this comment

EspenAlbert Jan 24, 2025

Choose a reason for hiding this comment

EspenAlbert Jan 24, 2025

Choose a reason for hiding this comment

EspenAlbert Jan 24, 2025

Choose a reason for hiding this comment

EspenAlbert Jan 24, 2025

Choose a reason for hiding this comment

EspenAlbert Jan 24, 2025

Choose a reason for hiding this comment

EspenAlbert left a comment

Choose a reason for hiding this comment

doc: Add example & documentation for `mongodbatlas_encryption_at_rest_private_endpoint` to specify AWS usage #2999

doc: Add example & documentation for `mongodbatlas_encryption_at_rest_private_endpoint` to specify AWS usage #2999

maastha commented Jan 23, 2025 •

edited

Loading

maastha Jan 23, 2025 •

edited

Loading

maastha Jan 23, 2025 •

edited

Loading

maastha Jan 23, 2025 •

edited

Loading