#1 - The AWS doc link from this page:
https://docs.atlas.mongodb.com/security-aws-kms/#std-label-security-aws-kms
should be to creating symmetric CMKs, not the generic create CMKs page (as it is now). E.g., proper target is this:
https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html#create-symmetric-cmk
 #2 - We should be explicit in all 3 cloud provider docs that the master key must be symmetric for AWS & GCP, and must be asymmetric (public/private) for Azure:
{{https://docs.atlas.mongodb.com/cluster-config/encryption/}}I suspect what happened is that when we only supported AWS we didn't specify, because the default was symmetric AES.