# Atlas security add-on uplifts (auditing, LDAP, customer-managed keys, private endpoints) > Source-anchored research for Atlas security add-on uplifts (auditing, LDAP, customer-managed keys, private endpoints). Run status: COMPLETED. Parent: [Cluster Tier Limits and Feature Gates as Cost Drivers (Connections, IOPS Caps, Minimum Tiers)](https://llms-explorer.com/tree/cluster-tier-limits-and-feature-gates-as-cost-drivers-connections-iops-caps-minimum-tiers/) · 5 facets · 17 facts · page: https://llms-explorer.com/tree/atlas-security-add-on-uplifts-auditing-ldap-customer-managed-keys-private-endpoints/ ## How it works - AWS charges for interface endpoints while provisioned in each Availability Zone, even when their service association is inactive, and rounds partial endpoint-hours up. Deleting an unused endpoint is therefore relevant to stopping its AWS hourly charges. (low confidence) (verified as of 2026-10-20) — [source](https://aws.amazon.com/privatelink/pricing/) ## Measurements and reference values - Atlas charges a 15% Advanced Security uplift on each cluster with LDAP authentication/authorization or customer-managed encryption keys enabled, excluding Atlas Enterprise and Platinum customers. The billing page describes one uplift for either feature; it does not state a separate 15% charge for each feature. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - Atlas bills Azure private-endpoint traffic in 1 GB capacity units for incoming and outgoing data. Its Google Cloud model combines a project-and-region hourly endpoint charge with 1 GB traffic units; provider endpoint charges are additional. A single uniform per-endpoint formula is therefore unsuitable across clouds. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - Customer-managed-key clusters also incur cloud key-management API-request costs in addition to the Atlas 15% uplift. Atlas explicitly notes that data validation can generate additional KMS requests. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) ## Problems, failure modes and limitations - Private endpoints for Atlas clusters require M10 or higher dedicated deployments; Free and Flex clusters cannot connect through private endpoints. Google Cloud independently documents that its Atlas private-connectivity example requires a paid dedicated tier. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security-private-endpoint.md) - Free and Flex clusters cannot enable Database Auditing. Enabling successful authorization-event auditing can severely affect cluster performance, creating a potential capacity cost beyond the explicit auditing uplift; the documentation does not quantify that capacity increase. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/database-auditing.md) - LDAP authentication and authorization is deprecated starting in MongoDB 8.0, but remains available throughout MongoDB 8; deprecation does not mean the Atlas feature or its fee has already disappeared. (medium confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security-ldaps.md) ## Comparisons and alternatives - Database Auditing adds 10% to the hourly cost of all dedicated clusters in projects using it, excluding Atlas Enterprise and Platinum customers. This is a project-wide billing scope rather than a charge only for selected audited users. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - For AWS, AWS Prescriptive Guidance lists overlapping CIDR blocks as supported for PrivateLink but not VPC peering. The AWS Atlas setup guide describes exposing an Atlas cluster through an endpoint in the customer's VPC. AWS charges for provisioned interface endpoint hours per Availability Zone and for data processed, so include those charges when PrivateLink addresses a peering constraint and compare total deployment costs rather than treating endpoints as universally cheapest. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/security-private-endpoint.md) ## Facts and statements - LDAP configuration applies to every cluster in a project. Customer key management configured at project level instead permits per-cluster enablement, so these features can expose different amounts of cluster spend to the uplift. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - The support comparison lists granular database auditing, encryption key management, and LDAP integration as M10+ add-ons under Developer and Pro, and as included for M10+ under Enterprise and Platinum. Inclusion therefore removes the add-on charge but does not remove the minimum cluster tier. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/services/support/atlas-support-plans) - AWS private connectivity has charges on both sides: Atlas endpoint-region and capacity-unit charges, plus AWS interface-endpoint provisioned hours per Availability Zone and data processing. A private connection is not evidence that network charges disappear. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - Atlas AWS Private Endpoint Capacity Units measure new connections, active connections, and processed bytes; Atlas bills only the highest-consuming dimension in each hour. These units meter endpoint traffic and must not be treated as a database-tier connection allowance. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - LDAP and Database Auditing are unavailable on Free and Flex clusters; customer key management is unavailable on Flex. These requirements can force a move to dedicated capacity before feature charges apply. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security-ldaps.md) - Atlas private endpoint charges vary by provider: AWS uses regional hourly endpoint charges plus capacity units; Azure meters bidirectional processed GB; Google Cloud dedicated clusters use project-region hourly charges plus processed GB. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - AWS bills customer interface endpoints per provisioned Availability Zone-hour and processed GB, separately from Atlas endpoint charges. Provisioned endpoints can cost money even without traffic; partial hours count as full hours. (high confidence) (verified as of 2026-10-20) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md) - Google Cloud charges consumers $0.01 per hour for a Private Service Connect forwarding-rule endpoint accessing a published service, plus bidirectional consumer data processing; these charges are additional to Atlas billing. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/billing/additional-services.md)