diff --git a/pkg/controller/atlasproject/encryption_at_rest.go b/pkg/controller/atlasproject/encryption_at_rest.go
index 5adcfcd3fa..74f7035665 100644
--- a/pkg/controller/atlasproject/encryption_at_rest.go
+++ b/pkg/controller/atlasproject/encryption_at_rest.go
@@ -85,6 +85,10 @@ func syncEncryptionAtRestsInAtlas(ctx *workflow.Context, projectID string, proje
 }
 
 func normalizeAwsKms(ctx *workflow.Context, projectID string, awsKms *mongodbatlas.AwsKms) error {
+	if awsKms == nil || awsKms.Enabled == nil || !*awsKms.Enabled {
+		return nil
+	}
+
 	// verify if role ID is set as AtlasObjectID
 	matched, err := regexp.MatchString(ObjectIDRegex, awsKms.RoleID)
 	if err != nil {