DocumentDB Connector

Pod Residency

nosql-scanner

Connection Method

URL connection via API

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources. For specific instructions for how to enable these credentials, refer to your data source's implementation documentation, knowledge base and/or support resources.

The main credential will be a username/password combination with a TLS/SSL protocol specified. Read permissions will need to be applied to grant adequate access to specific database/collection being scanned as set in the scan profile.

1. Download the region specific .pem key. The region is based on where the DocumentDB instance is deployed. The .pem keys can be found here.

2. On the Data Discovery menu, select Setup > Worker Nodes to choose your desired worker node.

3. In the Worker Details screen, navigate to the Configurations tab then expand the Security section.

4. Enable the setting Client Certificates. A Certificate(s) field appears.

5. Open the downloaded .pem key file in a text editor and copy the contents.

6. Paste this into the Certificate(s) field.

   
   
   

7. Click the Save button.

8. Click the Update to push the updates to the worker node.

9. Review the update status and confirm. This may take a few minutes.

10. Update your credentials in AWS Secret Manager to the following format:

    JSONCopy

    {  "connectionUrl": "mongodb://USERNAME:PASSWORD@documentdb-host.docdb.amazonaws.com:27017/?tls=true"  } 

    { 
        "connectionUrl": "mongodb://USERNAME:PASSWORD@documentdb-host.docdb.amazonaws.com:27017/?tls=true" 
    } 

Navigate to the DocumentDB server and under Connectivity & Security, you will see the associated security group(s) and the respective VPC ID(s). Next, navigate to your Data Discovery EKS cluster and under Networking, check whether the VPC associated with the EKS cluster is the same as seen in the security group.

If it's the same VPC

Allow the inbound access to 27017 on the DocumentDB security group for the EKS cluster.

If it's not the same VPC

Set up a VPC peering between the DocumentDB VPC and the Kubernetes cluster VPC

1. Navigate to the list of VPCs and find the main route table used by the cluster VPC.

2. Click on the associated main route table, then select Edit Routes.

3. For “Destination”, include the CIDR for the DocumentDB VPC. For “Target”, select the VPC Peering.

4. Navigate to the security group associated with the DocumentDB server and add inbound rule to allow the Kubernetes cluster CIDR to port 27017 on DocumentDB.