Senior LevelMongoDB & Mongoose
How do you manage KMS (AWS KMS, Azure Key Vault) key rotation for MongoDB CSFLE?
❓ Interview Prompt: Explain Key Management Services (AWS KMS), Data Encryption Keys (DEKs), Master Keys, and zero-downtime key rotation.
CSFLE uses Data Encryption Keys (DEKs) encrypted by a Master Key stored in AWS KMS. Key rotation re-encrypts DEKs with updated Master Keys without re-encrypting database fields.
Code Implementation Example
typescript
console.log('KMS Key Rotation re-encrypts DEK wrappers without modifying database ciphertext');💡CSFLE KMS key rotation architecture.
🎯 Interview Key Takeaway
Rotate KMS Master Keys by re-encrypting DEK wrappers without performing full database data rewrites.
#KMS#CSFLE#Key Rotation#Senior
Back to all MongoDB & Mongoose Questions→