How can I achieve the following goals?
- All compute and storage to be located in the cloud.
- Encryption in transit of all data between web nodes and db nodes running MongoDB.
- How to set up tunnels? Which protocols/tools?
- Encryption at rest of all data stored in MongoDB.
- All data is backed up (also to the cloud) frequently.
- Backups are encrypted in transit and at rest.
- All encryption and key management concerns are handled in the infrastructure, not in the application.
- Should not require any changes to the application code.
- Keys for all at-rest encryption can be rotated regularly.
- The key rotation process is simple, scriptable, automatable.
- Data stored in the past should be retrievable at any time, even after arbitrarily many key rotations.
- Backups should be retrievable for some period of time: they should survive at least one key rotation.
Please post, even if you only have partial answers or answers to a single bullet point. A solution to one sub-goal is part of the solution to the overall goal.
Thanks in advance for your answers!