Security best practices for Amazon DocumentDB
For security best practices, you must use AWS Identity and Access Management (IAM) accounts to control access to Amazon DocumentDB API operations, especially operations that create, modify, or delete Amazon DocumentDB resources. Such resources include clusters, security groups, and parameter groups. You must also use IAM to control actions that perform common administrative actions such as backing up restoring clusters. When creating IAM roles, employ the principle of least privilege.
-
Enforce least privilege with role-based access control.
-
Don't use the AWS account root user to manage Amazon DocumentDB resources. Instead, use AWS Identity and Access Management Identity Center to create human users with temporary credentials. For more information, see IAM Identity Center users in the IAM User Guide.
-
Grant each identity the minimum set of permissions required to perform their duties.
-
Use IAM policies to manage permissions and follow the principle of least privilege. For more information, see Security best practices in IAM in the IAM User Guide.
-
If you use IAM users with long-term credentials, rotate those credentials regularly.
Warning
This scenario requires IAM users with programmatic access and long-term credentials, which presents a security risk. To help mitigate this risk, we recommend that you provide these users with only the permissions they require to perform the task and that you remove these users when they are no longer needed. Access keys can be updated if necessary. For more information, see Update access keys in the IAM User Guide.
-
Configure Secrets Manager to automatically rotate the secrets for Amazon DocumentDB. For more information, see Rotating your secrets and Rotating secrets for Amazon DocumentDB in the AWS Secrets Manager User Guide.
-
Use Transport Layer Security (TLS) and encryption at rest to encrypt your data.
