Configure Security Features for Clusters

Encryption in Transit

Atlas requires TLS/SSL to encrypt the connections to your databases.

TLS/SSL certificates are:

• Valid for 90 days from the day Atlas issues the certificate.

• Rotated 42 days before the certificate's expiration date.

To learn more about TLS encryption, see the Atlas Security White Paper.

To configure SSL or TLS OCSP certificate revocation checking, see OCSP Certificate Revocation Check.

Virtual Private Cloud

All Atlas projects with one or more M10+ dedicated clusters receive their own dedicated VPC (or VNet if you use Azure). Atlas deploys all dedicated clusters inside this VPC or VNet.

Encryption at Rest

By default, Atlas encrypts all data stored on your Atlas clusters. Atlas also supports Encryption at Rest using your Key Management.

Network and Firewall Requirements

Make sure your application can reach your MongoDB Atlas environment. To add the inbound network access from your application environment to Atlas, do one of the following:

1. Add the public IP addresses to your IP access list

2. Use VPC / VNet peering to add private IP addresses.

3. Add private endpoints.

If your firewall blocks outbound network connections, you must also open outbound access from your application environment to Atlas. You must configure your firewall to allow your applications to make outbound connections to ports 27015 to 27017 to TCP traffic on Atlas hosts. This grants your applications access to databases stored on Atlas.

If you are not using VPC / VNet peering and plan to connect to Atlas using public IP addresses, see the following pages for additional information:

• Can I specify my own VPC for my MongoDB Atlas project?

• Do Atlas cluster's public IPs ever change?

IP Access List

Atlas only allows client connections to the cluster from entries in the project's IP access list. To connect, you must add an entry to the IP access list. To set up the IP access list for the project, see Configure IP Access List Entries.

For Atlas clusters deployed on Google Cloud Platform (GCP) or Microsoft Azure, add the IP addresses of your Google Cloud or Azure services to Atlas project IP access list to grant those services access to the cluster.

User Authentication or Authorization

Atlas requires clients to authenticate to connect to the database. You must create database users to access the database. To set up database users to your clusters, see Configure Database Users. Atlas offers many security features for cluster authentication and authorization.

To access clusters in a project, users must belong to that project. Users can belong to multiple projects.

Network Peering Connection

Atlas supports peering connections with other AWS, Azure, or Google Cloud network peering connections. To learn more, see Set Up a Network Peering Connection.

Private Endpoints

Atlas supports private endpoints on:

• AWS using the AWS PrivateLink feature

• Azure using the Azure Private Link feature

• Google Cloud using the GCP Private Service Connect feature

To use private endpoints, see Learn About Private Endpoints in Atlas.

Unified AWS Access

Some Atlas features, including Data Federation and Encryption at Rest using Customer Key Management, use AWS IAM roles for authentication.

To set up an AWS IAM role for Atlas to use, see Set Up Unified AWS Access.

Cluster Authentication and Authorization

Atlas offers the following security features for cluster authentication and authorization.

Encryption at Rest using your Key Management

Atlas supports using AWS KMS, Azure Key Vault, and Google Cloud to encrypt storage engines and cloud provider backups. To use encryption at rest, see Encryption at Rest using Customer Key Management.

Client-Side Field Level Encryption

Atlas supports client-side field level encryption, including automatic encryption of fields. All Atlas users are entitled to use MongoDB's automatic client-side field level encryption features.

To learn more, see Client-Side Field Level Encryption Requirements.

Database Auditing

Atlas supports auditing all system event actions. To use database auditing, see Set up Database Auditing.

Access Tracking

Atlas surfaces authentication logs directly in the Atlas UI so that you can easily review successful and unsuccesful authentication attempts made against your clusters. To view your database access history, see View Database Access History.

Multi-Factor Authentication for Atlas UI Access

Atlas supports MFA to help you control access to your Atlas accounts. To set up MFA, see Manage Your Multi-Factor Authentication Options.

Allow Access to or from the Atlas Control Plane

If you use any of the following Atlas features, you might have to add Atlas IP addresses to your network's IP access list:

• Alert Webhooks

• Encryption at Rest using Customer Key Management

  Note

  If you enable the Encryption at Rest feature, you must allow access from public IPs for all your hosts in your deployment, including CSRS (Config Server Replica Sets) if you are using sharded clusters.

{
  "controlPlane": {
    "inbound": {
      "aws": { // cloud provider
        "us-east-1": [ // region
          "3.92.113.229/32",
          "3.208.110.31/32",
          "107.22.44.69/32"
          ...,
        ],
        ...
       }
     },
     "outbound": {
       "aws": { // cloud provider
         "us-east-1": [ // region
           "3.92.113.229/32",
           "3.208.110.31/32",
           "107.22.44.69/32"
           ...,
         ],
         ...
        }
      }
  },
  "data_federation": {
    "inbound": {},
    "outbound" {}
  },
  "app_services": {
    "inbound": {},
    "outbound" {}
  },
  ...
}

Allow Access to Data Federation

If your network allows outbound requests to specific IP addresses only, you must allow access to the following IP addresses on TCP port 27017 so that your requests can reach the federated database instance:

108.129.35.102
13.54.14.65
18.138.155.47
18.140.240.47
18.196.201.253
18.200.7.156
18.204.47.197
18.231.94.191
3.122.67.212
3.6.3.105
3.8.218.156
3.9.125.156
3.9.90.17
3.98.247.136
3.99.32.43
3.130.39.53
3.132.189.43
35.206.65.216
35.209.197.46
35.210.31.154
35.210.66.17
20.23.173.153
20.23.171.79
20.96.56.124
20.190.207.191
20.197.103.232
20.197.103.246
34.217.220.13
34.237.78.67
35.158.226.227
52.192.130.90
52.193.61.21
52.64.205.136
54.203.115.97
54.69.142.129
54.91.120.155
54.94.3.214
65.1.222.250
99.81.123.21

OCSP Certificate Revocation Check

If your network allows outbound requests to specific IP addresses only, to allow SSL or TLS OCSP certificate revocation checking, you must allow access to Atlas' CA (Certificate Authority) OCSP Responder servers that can be found in the OCSP URL of the SSL or TLS certificate.

To disable OCSP certificate revocation checking, refer to the documentation for the MongoDB driver version that your application uses.