Key Management for Data-at-Rest Encryption in Percona Server for MongoDB
summary
Percona Server for MongoDB encrypts each database with a per-database AES key that is stored in an encryption key DB and protected by a master key kept in KMIP or Vault. Setup requires a clean data directory; rotation re-encrypts only the encryption key DB (not all data). Vault’s default max versions of 10 can silently overwrite old keys—risking data loss unless increased (Vault supports up to ~24,000). The server polls key state every 15 minutes polling and will terminate a node if its master key is not active to force coordinated rotation and recovery.
AI-written summary · about
chapters (15)
- 0:00Data-at-rest encryption intro
- 1:50Encryption types in Percona Server
- 3:15Why encrypt data-at-rest
- 4:42How encryption works
- 6:28Key Management Systems overview
- 9:45Percona Server with KMIP
- 11:32Percona Server with HashiCorp Vault
- 12:59Master key rotation
- 16:14Handling compromised keys
- 19:12KMIP key state verification
- 23:58Vault secret versioning limits
- 27:31Vault permissions for Percona
- 28:57KMIP and Vault licensing
- 31:04Best practices
- 32:54Q&A
related talks
32mAchieving PCI Compliance With Percona Server for MongoDB, or Getting as Close as Possible
09mOpen Software for MongoDB Where Percona Fits
41mRunning MongoDB securely on AWS using field-level encryption
25mPercona Server for MongoDB: Features Overview
44mSecret Management with Hashicorp's Vault
37mThe State of MongoDB, Its Open Source Community, and Where Percona Is Going With It
51mIntroduction to Vault
59mDatabase Encryption in a GDPR World