Amazon DocumentDB

What it is

Amazon DocumentDB (with MongoDB compatibility) is a fully managed document database. It stores data as JSON (JavaScript Object Notation)A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.Glossary entry-like documents in collections and is compatible with the MongoDB 3.6, 4.0, 5.0, and 8.0 API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, so many existing MongoDB applications, drivers, and tools work with it. AWS handles hardware, patching, backups, and FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry.

Its architecture is similar to Amazon Aurora: compute and storage are separate, and all instances in a cluster share one cluster volume that keeps six copies of the data across three AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry and grows on its own.

Choose DocumentDB when an application already uses MongoDB, or naturally stores flexible, nested JSON documents (catalogs, user profiles, content management) and you want a managed service. Compatibility is not complete, so check the functional differences before migrating. If you are building a new key-value workload and want fully serverless scale, compare it with Amazon DynamoDB.

Concepts

Instance-based cluster: one primary instance for writes and up to 15 replicas for reads, all on the shared cluster volume. The volume grows in 10 GB steps, up to 128 TiB (256 TiB with engine version 8.0 and later).
Endpoints: the cluster endpoint goes to the primary, the reader endpoint balances reads across replicas, and instance endpoints reach one instance. AWS recommends connecting as a replica set and setting a read preference in the driver.
Elastic clusters: for very large workloads, with millions of reads and writes per second and petabytes of storage. Data is sharded by a shard key, up to 32 shards, and you scale by changing shard count and capacity, without managing instances.
DocumentDB serverless: capacity in DocumentDB capacity units (DCUs), each about 2 GiB of memory with CPU and networking, scaling between 0.5 and 256 DCUs (engine versions 5.0 and 8.0).
Change streams: a time-ordered sequence of change events in your collections, kept for 3 hours by default and up to 7 days, for Event-driven architectureA design in which services react to events that other services emit, such as an order placed or a file uploaded, instead of calling each other directly. Amazon EventBridge, Amazon SNS, Amazon SQS, and AWS Lambda are common building blocks.Glossary entry processing.
Vector search: on DocumentDB 5.0 and later instance-based clusters, store vector embeddings in your documents and search them with an HNSW or IVFFlat index, using Euclidean, cosine, or dot product similarity. Indexes cover vectors of up to 2,000 dimensions. Use it for semantic search and recommendations over data you already keep in DocumentDB.

Security, resilience, performance, and cost

Security

Clusters run inside your VPC and are reached through Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry; they aren't exposed directly to the internet.
TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry Encryption in transitEncrypting data while it moves across a network, usually with TLS, so that it cannot be read or changed on the way.Glossary entry is on by default for new clusters.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry with AWS KMS is chosen when you create the cluster and covers all instances, backups, and snapshots.
Authenticate with database users and roles, or with IAM users and roles.
Auditing sends DDL, DML, authentication, and user management events to CloudWatch Logs; CloudTrail records API calls.

Resilience

Failover: if the primary fails, a replica is promoted, typically within 30 seconds. Failover tiers set which replica is promoted first. With no replicas, DocumentDB has to create a new primary, which takes longer.
Backups are continuous to S3, with a retention of 1 to 35 days and restore to any point in that period; you can also take manual snapshots.
Global clusters: one primary AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry and up to 10 read-only secondary Regions. RPO (Recovery point objective)The most data, measured in time, that a workload can afford to lose in a disaster. With an RPO of one hour, data must be restorable to no more than an hour before the failure.Glossary entry is typically measured in seconds, and a secondary can be promoted with an RTO (Recovery time objective)The longest acceptable time between a disruption and the workload being available again.Glossary entry typically under a minute.

Performance

Scale reads with replicas, scale up by changing instance class, or use serverless for variable load and elastic clusters to scale writes beyond one primary.
Use the profiler to find slow operations, and design indexes for your queries.

Cost

Pay for instances (or serverless DCUs, or elastic cluster capacity), storage, backup storage, and, with the Standard configuration, I/O.
The I/O-Optimized configuration includes I/O in the price, for I/O-heavy or predictable-cost workloads.
Database Savings Plans cover DocumentDB.

Monitoring

CloudWatch metrics, the profiler for slow queries, audit logs in CloudWatch Logs, and Performance Insights.

DocumentDB or another option?

If the requirement is	Choose
Managed MongoDB-compatible document database	Amazon DocumentDB
A MongoDB workload that needs sharding across huge scale	DocumentDB elastic clusters
Serverless key-value or document access, designed around keys	Amazon DynamoDB
Relational data with joins and SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry	Amazon RDS or Aurora
Full-text search and log analytics	Amazon OpenSearch Service
Self-managed MongoDB with full control	MongoDB on EC2

Reverse mindmap: when the question points here

Is it Amazon DocumentDB?

Yes, when the question says
- Migrate MongoDB to a managed AWS service leads to DocumentDB
- MongoDB-compatible drivers and APIs leads to DocumentDB
- Flexible JSON documents with rich queries leads to DocumentDB
Choose the feature
- Scale reads leads to Up to 15 replicas, reader endpoint
- Millions of writes per second, sharding leads to Elastic clusters
- Variable load, no instance sizing leads to DocumentDB serverless
- Cross-Region DR and local reads leads to Global clusters
- React to document changes leads to Change streams
- Restore to a point in the last 35 days leads to Continuous backups
No, when the question says
- Serverless key-value at any scale leads to DynamoDB
- Cassandra workloads leads to Keyspaces
- Graph relationships leads to Neptune

Key takeaways

DocumentDB is a managed document database compatible with the MongoDB 3.6, 4.0, 5.0, and 8.0 APIs.
Storage is shared and separate from compute: six copies across three Availability Zones, growing up to 128 TiB (256 TiB on 8.0).
Up to 15 replicas, which are failover targets; failover typically completes within 30 seconds.
Elastic clusters shard data for millions of operations per second; serverless scales between 0.5 and 256 DCUs.
Global clusters reach up to 10 secondary Regions, with RPO in seconds.
Encryption at rest is chosen at creation; TLS is on by default.