# Security Groups > Depth-first rabbithole dossier for Security Groups; source-anchored research pack. Parent: [MongoDB Atlas AWS Networking](https://llms-explorer.com/tree/mongodb-atlas-aws-networking/) · 4 facets · 13 facts · page: https://llms-explorer.com/tree/security-groups/ ## Definitions - [low] Security groups are stateful, which means that information about previously sent or received traffic is saved. Sources: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#core` ## How it works - [low] In order to use AWS Security Group(s), VPC Peering must be enabled. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/docs/resources/project_ip_access_list.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#patterns` - [low] If you route traffic between two instances in different subnets through a middlebox appliance and reference the security group of the other instance as the source, this does not allow traffic to flow between the instances; reference the other instance's private IP address or its subnet CIDR range instead. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#antipatterns` - [low] When a security group rule becomes stale, it's not automatically removed from your security group—you must manually remove it. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#troubleshooting` - [low] If a security group rule is stale because the VPC peering connection was deleted, the rule will no longer be marked as stale if you create a new VPC peering connection with the same VPCs. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#troubleshooting` ## Problems, failure modes and limitations - [low] You can't reference the security group of a peer VPC that's in a different Region; instead, use the CIDR block of the peer VPC. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#core` ## Facts and statements - [low] Atlas does not support adding AWS security groups to IP access lists in projects with VPC peering connections in multiple regions. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#core` - [low] For AWS security groups, Atlas configures the IP access list entry for every container provisioned in the project for the listed regions, but not for any other containers. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#core` - [low] For AWS clusters with VPC peering connections to the same region, you can specify a Security Group associated with the peer VPC. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#core` - [low] Create a network traffic rule on your AWS security group attached to resources connecting to Atlas to allow outbound traffic on ports 27015-27017 inclusive to your Atlas CIDR. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#core` - [low] To reference a security group in a peer VPC, the VPC peering connection must be in the active state. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#core` - [low] For a peer VPC in a different account but the same Region, enter the account ID and security group ID, separated by a forward slash (for example, 123456789012/sg-1a2b3c4d). Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#tools` - [low] If the VPC peering connection is deleted, or if the owner of the peer VPC deletes the referenced security group, the security group rule becomes stale. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/security-groups-75c7c20846/rabbithole-synthesis.md#troubleshooting` ## Related concepts - Security — is a part of Security Groups - Groups — is a part of Security Groups