View a markdown version of this page

Security best practices for Amazon DocumentDB - Amazon DocumentDB
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Security best practices for Amazon DocumentDB

Amazon DocumentDB provides security features including Amazon VPC isolation, encryption at rest using Amazon KMS, encryption in transit using TLS, and fine-grained access control through IAM. Use the following best practices to secure your Amazon DocumentDB clusters, instances, and data.

Use Amazon Identity and Access Management (IAM) roles to control access to Amazon DocumentDB API operations. This includes operations that create, modify, or delete Amazon DocumentDB resources such as clusters, security groups, and parameter groups. When applications or other Amazon services need to access Amazon DocumentDB resources, use an IAM role to provide temporary credentials rather than storing long-term credentials in your application. When creating IAM roles, apply the principle of least privilege. For more information, see IAM roles and Common scenarios for roles in the IAM User Guide.

  • Enforce least privilege with role-based access control.

  • Don't use the Amazon Web Services account root user to manage Amazon DocumentDB resources. Instead, use Amazon Identity and Access Management Identity Center to create human users with temporary credentials. For more information, see IAM Identity Center users in the IAM User Guide.

  • Grant each identity the minimum set of permissions required to perform their duties.

  • Use IAM policies to manage permissions and follow the principle of least privilege. For more information, see Security best practices in IAM in the IAM User Guide.

  • If you use IAM users with long-term credentials, rotate those credentials regularly.

    Warning

    This scenario requires IAM users with programmatic access and long-term credentials, which presents a security risk. To help mitigate this risk, we recommend that you provide these users with only the permissions they require to perform the task and that you remove these users when they are no longer needed. Access keys can be updated if necessary. For more information, see Update access keys in the IAM User Guide.

  • Configure Secrets Manager to automatically rotate the secrets for Amazon DocumentDB. For more information, see Rotating your secrets and Rotating secrets for Amazon DocumentDB in the Amazon Secrets Manager User Guide.

  • Use Transport Layer Security (TLS) and encryption at rest to encrypt your data.