Navigation

Security Features and Setup

On this page

Make sure your application can reach your MongoDB Atlas environment. To add the inbound network access from your application environment to Atlas, do one of the following:

  1. Add the public IP addresses to your IP access list
  2. Use VPC / VNet peering to add private IP addresses.
Tip
See also:

IP Access List

If your firewall blocks outbound network connections, you must also open outbound access from your application environment to Atlas. You must configure your firewall to allow your applications to make outbound connections to ports 27015 to 27017 to TCP traffic on Atlas hosts. This grants your applications access to databases stored on Atlas.

Note

By default, MongoDB Atlas clusters do not need to be able to initiate connections to your application environments. If you wish to enable Atlas clusters with LDAP authentication and authorization, you must allow network access from Atlas clusters directly to your secure LDAP. You can allow access to your LDAP by using public or private IPs as long as a public DNS hostname points to an IP that the Atlas clusters can access.

If you are not using VPC / VNet peering and plan to connect to Atlas using public IP addresses, see the following pages for additional information:

The following security features are part of the Atlas product:

Atlas uses TLS/SSL to encrypt the connections to your databases.

To configure SSL or TLS OCSP certificate revocation checking, see OCSP Certificate Revocation Check.

Important

If this is the first M10+ dedicated paid cluster for the selected region or regions and you plan on creating one or more VPC peering connections, please review the documentation on VPC peering connections before continuing.

You must configure the following security features:

Atlas only allows client connections to the database deployment from entries in the project's IP access list. To connect, you must add an entry to the IP access list. To set up the IP access list for the project, see Configure IP Access List Entries.

For Atlas clusters deployed on Google Cloud Platform (GCP) or Microsoft Azure, add the IP addresses of your GCP or Azure services to Atlas project IP access list to grant those services access to the cluster.

Atlas requires clients to authenticate to access the database deployments. You must create database users to access the database. To set up database users to your database deployments, see Configure Database Users.

To access database deployments in a project, users must belong to that project. Users can belong to multiple projects.

Tip
See also:

Atlas User Access.

You may configure the following security features:

Atlas supports creating custom roles in cases where the built-in Atlas database user privileges cannot describe your desired set of privileges.

Atlas supports VPC peering with other AWS, Azure, or GCP VPCs. To use VPC Peering, see Set up a Network Peering Connection.

Atlas supports private endpoints on:

To use private endpoints, see Set up a Private Endpoint.

Atlas supports Two Factor Authentication (2FA) to help users control access to their Atlas accounts. To use 2FA, see Legacy Two Factor Authentication.

Atlas supports performing user authentication and authorization with LDAP. To use LDAP, see Set up User Authentication and Authorization with LDAP.

Some Atlas features, including Data Lakes and Encryption at Rest using Customer Key Management, use AWS IAM roles for authentication.

To set up an AWS IAM role for Atlas to use, see Set Up Unified AWS Access.

Atlas supports using AWS KMS, Azure Key Vault, and GCP to encrypt storage engines and cloud provider backups. To use encryption at rest, see Encryption at Rest using Customer Key Management.

Atlas supports client-side field level encryption, including automatic encryption of fields.

Note

All Atlas users are entitled to use MongoDB's automatic client-side field level encryption features.

Minimum Driver and mongosh Version

The following support client-side field level encryption:

For more information on official MongoDB drivers, see MongoDB Drivers.

Minimum Server Version
Drivers and mongosh can only use client-side field level encryption if connected to a Atlas database deployment running MongoDB 4.2 or later.
Note

MongoDB Compass, the Data Explorer, and the MongoDB Shell (mongosh) do not support decrypting client-side field level-encrypted fields.

Tip
See also:

Atlas supports auditing all system event actions. To use database auditing, see Set up Database Auditing.

Organization owners can restrict MongoDB Production Support Employees from accessing Atlas backend infrastructure for any Atlas database deployment in their organization. Organization owners may grant a 24 hour bypass to the access restriction at the Atlas database deployment level.

Important

Restricting infrastructure access for MongoDB Production Support Employees may increase support issue response and resolution time and negatively impact your database deployment's availability.

To enable this option, see Restrict MongoDB Support Access to Atlas Backend Infrastructure.

Atlas surfaces authentication logs directly in the UI so that you can easily review successful and unsuccesful authentication attempts made against your database deployments. To view your database access history, see View Database Access History.

If you use any of the following Atlas features, you might have to add Atlas IP addresses to your network's IP access list:

If your network allows outbound HTTP requests only to specific IP addresses, you must allow access to the following IP addresses so that your API requests can reach the Atlas control plane:

3.214.160.189
13.248.140.125
13.248.203.97
13.248.214.115
18.210.185.2
18.210.245.203
18.232.30.107
18.235.209.93
34.192.82.120
34.194.131.15
34.194.251.66
34.195.194.204
34.227.138.166
34.230.213.36
34.233.152.179
34.233.179.140
35.172.148.213
35.172.245.18
54.147.76.65
54.204.237.208
75.2.1.110
76.223.14.2
76.223.77.37
76.223.84.31
99.83.223.45

If your network allows inbound HTTP requests only from specific IP addresses, you must allow access from the following IP addresses so that Atlas can communicate with your webhooks and KMS:

18.214.178.145
18.235.145.62
18.235.30.157
18.235.48.235
34.193.242.51
34.196.151.229
34.200.66.236
34.235.52.68
35.153.40.82
35.169.184.216
35.171.106.60
35.174.179.65
35.174.230.146
35.175.93.3
35.175.94.38
35.175.95.59
52.71.233.234
52.87.98.128
107.20.0.247
107.20.107.166

If your network allows outbound requests to specific IP addresses only, you must allow access to the following IP addresses on TCP port 27017 so that your requests can reach Data Lake:

18.204.47.197
34.237.78.67
54.91.120.155
34.217.220.13
54.203.115.97
54.69.142.129
108.129.35.102
18.200.7.156
99.81.123.21
3.8.218.156
3.9.125.156
3.9.90.17
18.196.201.253
3.122.67.212
35.158.226.227
13.54.14.65
52.64.205.136

If your network allows outbound requests to specific IP addresses only, to allow SSL or TLS OCSP certificate revocation checking, you must allow access to Atlas' CA (Certificate Authority) OCSP Responder servers that can be found in the OCSP URL of the SSL or TLS certificate.

To disable OCSP certificate revocation checking, refer to the documentation for the MongoDB driver version that your application uses.

© MongoDB, Inc 2008-present. MongoDB, Mongo, and the leaf logo are registered trademarks of MongoDB, Inc.

Give Feedback

On this page