Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

doc: Updates existing documentation for mongodbatlas_encryption_at_rest resource to be auto-generated #2529

Merged
merged 2 commits into from
Aug 28, 2024
Merged

doc: Updates existing documentation for mongodbatlas_encryption_at_rest resource to be auto-generated #2529

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d0d29e6
add auto-generated documenattion
maastha Aug 27, 2024
006e819
add documentation
maastha Aug 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 56 additions & 25 deletions docs/resources/encryption_at_rest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ See [Encryption at Rest](https://docs.atlas.mongodb.com/security-kms-encryption/

Copy link
Member

@AgustinBettati AgustinBettati Aug 28, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can add this resource in https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/.github/workflows/code-health.yml#L77 so that we ensure it stays aligned.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that was also my comment :-)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed offline with @AgustinBettati . I have updated https://jira.mongodb.org/browse/CLOUDP-267668 to ensure we add this check after updating the examples as part of adding the data source for this resource.

-> **IMPORTANT NOTE** To disable the encryption at rest with customer key management for a project all existing clusters in the project must first either have encryption at rest for the provider set to none, e.g. `encryption_at_rest_provider = "NONE"`, or be deleted.

## Example Usage
## Example Usages

```terraform
resource "mongodbatlas_encryption_at_rest" "test" {
Expand Down Expand Up @@ -106,39 +106,70 @@ resource "mongodbatlas_advanced_cluster" "example_cluster" {

```

## Argument Reference

* `project_id` - (Required) The unique identifier for the project.
<!-- schema generated by tfplugindocs -->
## Schema

### aws_kms_config
Refer to the example in the [official github repository](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/master/examples) to implement Encryption at Rest
* `enabled` - Specifies whether Encryption at Rest is enabled for an Atlas project, To disable Encryption at Rest, pass only this parameter with a value of false, When you disable Encryption at Rest, Atlas also removes the configuration details.
* `customer_master_key_id` - The AWS customer master key used to encrypt and decrypt the MongoDB master keys.
* `region` - The AWS region in which the AWS customer master key exists: CA_CENTRAL_1, US_EAST_1, US_EAST_2, US_WEST_1, US_WEST_2, SA_EAST_1
Copy link
Collaborator Author

@maastha maastha Aug 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per enums for this field in https://www.mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/Encryption-at-Rest-using-Customer-Key-Management/operation/getEncryptionAtRest
and
https://www.mongodb.com/docs/atlas/security-aws-kms/ this list of regions isn't valid anymore

* `role_id` - ID of an AWS IAM role authorized to manage an AWS customer master key. To find the ID for an existing IAM role check the `role_id` attribute of the `mongodbatlas_cloud_provider_access` resource.
### Required

### azure_key_vault_config
* `enabled` - Specifies whether Encryption at Rest is enabled for an Atlas project. To disable Encryption at Rest, pass only this parameter with a value of false. When you disable Encryption at Rest, Atlas also removes the configuration details.
* `client_id` - The client ID, also known as the application ID, for an Azure application associated with the Azure AD tenant.
* `azure_environment` - The Azure environment where the Azure account credentials reside. Valid values are the following: AZURE, AZURE_CHINA, AZURE_GERMANY
* `subscription_id` - The unique identifier associated with an Azure subscription.
* `resource_group_name` - The name of the Azure Resource group that contains an Azure Key Vault.
* `key_vault_name` - The name of an Azure Key Vault containing your key.
* `key_identifier` - The unique identifier of a key in an Azure Key Vault.
* `secret` - The secret associated with the Azure Key Vault specified by azureKeyVault.tenantID.
* `tenant_id` - The unique identifier for an Azure AD tenant within an Azure subscription.
- `project_id` (String) Unique 24-hexadecimal digit string that identifies your project. Use the [/groups](#tag/Projects/operation/listProjects) endpoint to retrieve all projects to which the authenticated user has access.

### google_cloud_kms_config
* `enabled` - Specifies whether Encryption at Rest is enabled for an Atlas project. To disable Encryption at Rest, pass only this parameter with a value of false. When you disable Encryption at Rest, Atlas also removes the configuration details.
* `service_account_key` - String-formatted JSON object containing GCP KMS credentials from your GCP account.
* `key_version_resource_id` - The Key Version Resource ID from your GCP account.
**NOTE**: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.

## Import
### Optional

- `aws_kms_config` (Block List) Amazon Web Services (AWS) KMS configuration details and encryption at rest configuration set for the specified project. (see [below for nested schema](#nestedblock--aws_kms_config))
- `azure_key_vault_config` (Block List) Details that define the configuration of Encryption at Rest using Azure Key Vault (AKV). (see [below for nested schema](#nestedblock--azure_key_vault_config))
- `google_cloud_kms_config` (Block List) Details that define the configuration of Encryption at Rest using Google Cloud Key Management Service (KMS). (see [below for nested schema](#nestedblock--google_cloud_kms_config))

### Read-Only

- `id` (String) The ID of this resource.

<a id="nestedblock--aws_kms_config"></a>
### Nested Schema for `aws_kms_config`

Optional:

- `access_key_id` (String, Sensitive) Unique alphanumeric string that identifies an Identity and Access Management (IAM) access key with permissions required to access your Amazon Web Services (AWS) Customer Master Key (CMK).
- `customer_master_key_id` (String, Sensitive) Unique alphanumeric string that identifies the Amazon Web Services (AWS) Customer Master Key (CMK) you used to encrypt and decrypt the MongoDB master keys.
- `enabled` (Boolean) Flag that indicates whether someone enabled encryption at rest for the specified project through Amazon Web Services (AWS) Key Management Service (KMS). To disable encryption at rest using customer key management and remove the configuration details, pass only this parameter with a value of `false`.
- `region` (String) Physical location where MongoDB Cloud deploys your AWS-hosted MongoDB cluster nodes. The region you choose can affect network latency for clients accessing your databases. When MongoDB Cloud deploys a dedicated cluster, it checks if a VPC or VPC connection exists for that provider and region. If not, MongoDB Cloud creates them as part of the deployment. MongoDB Cloud assigns the VPC a CIDR block. To limit a new VPC peering connection to one CIDR block and region, create the connection first. Deploy the cluster after the connection starts.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is MongoDB Cloud something specific and distinct from MongoDB Atlas? I think you want to refer to MongoDB Atlas here, and in all other places where this term is used.

- `role_id` (String) Unique 24-hexadecimal digit string that identifies an Amazon Web Services (AWS) Identity and Access Management (IAM) role. This IAM role has the permissions required to manage your AWS customer master key.
- `secret_access_key` (String, Sensitive) Human-readable label of the Identity and Access Management (IAM) secret access key with permissions required to access your Amazon Web Services (AWS) customer master key.


<a id="nestedblock--azure_key_vault_config"></a>
### Nested Schema for `azure_key_vault_config`

Optional:

- `azure_environment` (String) Azure environment in which your account credentials reside.
- `client_id` (String, Sensitive) Unique 36-hexadecimal character string that identifies an Azure application associated with your Azure Active Directory tenant.
- `enabled` (Boolean) Flag that indicates whether someone enabled encryption at rest for the specified project. To disable encryption at rest using customer key management and remove the configuration details, pass only this parameter with a value of `false`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about 'Flag that indicates encryption at rest is enabled for the specified project'?

- `key_identifier` (String, Sensitive) Web address with a unique key that identifies for your Azure Key Vault.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not clear what "identifies for your Azure Key Vault" is supposed to convey, because of the placement of "for". Given that there is a key_vault_name field after this, it doesn't seem like this is meant to be "identifies your Azure Key Vault".

- `key_vault_name` (String) Unique string that identifies the Azure Key Vault that contains your key.
- `require_private_networking` (Boolean) Enable connection to your Azure Key Vault over private networking.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An earlier boolean field was describe as a "flag that . . .". Let's aim for alignment and refer to this as a 'Flag that enables'

- `resource_group_name` (String) Name of the Azure resource group that contains your Azure Key Vault.
- `secret` (String, Sensitive) Private data that you need secured and that belongs to the specified Azure Key Vault (AKV) tenant (**azureKeyVault.tenantID**). This data can include any type of sensitive data such as passwords, database connection strings, API keys, and the like. AKV stores this information as encrypted binary data.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about 'AKV tenant private data to store as encrypted binary data.' I think the explication of what use-cases are suitable can be dropped.

- `subscription_id` (String, Sensitive) Unique 36-hexadecimal character string that identifies your Azure subscription.
- `tenant_id` (String, Sensitive) Unique 36-hexadecimal character string that identifies the Azure Active Directory tenant within your Azure subscription.


<a id="nestedblock--google_cloud_kms_config"></a>
### Nested Schema for `google_cloud_kms_config`

Optional:

- `enabled` (Boolean) Flag that indicates whether someone enabled encryption at rest for the specified project. To disable encryption at rest using customer key management and remove the configuration details, pass only this parameter with a value of `false`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the extraneous space between 'specified' and 'project'.

- `key_version_resource_id` (String, Sensitive) Resource path that displays the key version resource ID for your Google Cloud KMS.
- `service_account_key` (String, Sensitive) JavaScript Object Notation (JSON) object that contains the Google Cloud Key Management Service (KMS). Format the JSON as a string and not as an object.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

. . . as a string, not an object.


# Import
Encryption at Rest Settings can be imported using project ID, in the format `project_id`, e.g.

```
$ terraform import mongodbatlas_encryption_at_rest.example 1112222b3bf99403840e8934
```

For more information see: [MongoDB Atlas API Reference for Encryption at Rest using Customer Key Management.](https://www.mongodb.com/docs/atlas/reference/api-resources-spec/#tag/Encryption-at-Rest-using-Customer-Key-Management)
For more information see: [MongoDB Atlas API Reference for Encryption at Rest using Customer Key Management.](https://www.mongodb.com/docs/atlas/reference/api-resources-spec/#tag/Encryption-at-Rest-using-Customer-Key-Management)
Loading