Skip to Main Content

MongoByte MongoDB Logo

Welcome to the new MongoDB Feedback Portal!

{Improvement: "Your idea"}
We’ve upgraded our system to better capture and act on your feedback.
Your feedback is meaningful and helps us build better products.

Status Submitted
Created by Guest
Created on Nov 24, 2023

reencrypt existing snapshot with new kmip key

Customer may decide to migrate from one KMIP provider to another or from one KMIP server to another. If you need store backups for a long period of time (7 years for compliant reason is not an exception), it becomes difficult to make sure that you can restore snapshots from old keys and all old KMIP servers still up and running. it turns out that it's not possible to export old keys from one kmip provider and import into another kmip provider due to security reasons. But at the same time - it looks like much easier to implement option to run command in OPS Manager and specify new (current) KMIP key and re-encrypt existing snapshot, having access for a short period of time to both KMIP servers. As I understand similar concept used in Aurora Postgres when you can export snapshot from one AWS account to another by re-encypting KMS key.