# VPC Atlas Security > Source-anchored research for VPC Atlas Security. Run status: COMPLETED. Parent: [Global AI Hub Research Corpus](https://llms-explorer.com/tree/global-ai-hub-research-corpus/) · 3 facets · 17 facts · page: https://llms-explorer.com/tree/vpc-atlas-security/ ## How-to and procedures - Use an Atlas private endpoint-aware connection string for endpoint traffic. Atlas recommends its DNS seedlist form so clients discover changing port assignments; standard connection strings serve other access paths. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security-private-endpoint.md) ## Comparisons and alternatives - Private endpoints let applications reach Atlas through cloud-private connectivity instead of sending database traffic over the public internet. (high confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md) - For AWS PrivateLink, Atlas can assign ports in 1024-65535 and change them after cluster changes. MongoDB recommends DNS seedlist endpoint-aware connection strings and allowing the full endpoint port range rather than pinning individual ports. (low confidence) (verified as of 2026-10-29) — [source](https://www.mongodb.com/docs/atlas/security-private-endpoint.md) ## Facts and statements - Atlas private endpoints let clients initiate private connections to Atlas without allowing Atlas to initiate reciprocal connections into the client VPC; AWS describes this as preserving the network trust boundary. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md) - Atlas network guidance places dedicated clusters in a dedicated project VPC or VNet and requires TLS for database connections. (low confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md) - For VPC peering, the customer and Atlas address ranges must not overlap; address planning is a prerequisite for the private route. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md) - Enabling private endpoints does not disable other Atlas access methods: public IP access-list entries and network peering can coexist. A private-only design must separately review and remove unwanted public access permissions. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security-private-endpoint.md) - Private network reachability does not replace database authentication. AWS guidance lists authentication integrations separately from private connectivity, and the PrivateLink walkthrough still requires a database user. (medium confidence) — [source](https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-mongodb-atlas/best-practices.html) - Clients must select the private endpoint-aware connection string to use the endpoint path; the AWS and Confluent walkthroughs configure a private connection explicitly. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security-private-endpoint.md) - MongoDB architecture guidance recommends private endpoints for staging and production; Confluent independently recommends private networking for production integrations handling sensitive data. (medium confidence) (verified as of 2026-02-20) — [source](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md) - In the October 2021 Terraform issue #590, creating a second endpoint service in the same Atlas project and AWS region returned PRIVATE_ENDPOINT_SERVICE_ALREADY_EXISTS_FOR_REGION. A maintainer demonstrated referencing the existing endpoint service for multiple interface endpoints. This is historical troubleshooting evidence, not proof of an unresolved current defect. (low confidence) — [source](https://github.com/mongodb/terraform-provider-mongodbatlas/issues/590) - Macquarie Bank engineers reported that incorrect peering configuration could expose internal services to Atlas and that mitigating the network trust risks added firewall and VPN operational complexity. (low confidence) — [source](https://medium.com/macquarie-engineering-blog/implementing-private-service-connect-in-macquarie-banks-journey-to-100-cloud-native-ed6182a4bf92) - For Atlas integrations, private networking provides an alternative to public-IP access listing; Confluent recommends private connectivity for production and sensitive data. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md) - Network isolation does not replace database identity controls. Atlas requires TLS for database connections, and the AWS PrivateLink walkthrough still authenticates with a database user. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/architecture/current/network-security.md) - Atlas documents private endpoint support for dedicated M10-or-higher clusters. An endpoint's provisioned status alone therefore does not establish that a particular cluster tier can use it. (low confidence) (verified as of 2026-10-29) — [source](https://www.mongodb.com/docs/atlas/security-private-endpoint.md) - Confluent's 2020 walkthrough demonstrates a managed Atlas connector using a customer VPC and PrivateLink without opening Atlas to 0.0.0.0/0; its 2026 guidance instead describes public connectivity through specific Confluent egress IP allowlisting. (medium confidence) (verified as of 2026-02-20) — [source](https://www.confluent.io/blog/mongodb-atlas-connector-in-secure-environments/) - Validate the database connection from the intended application network after provisioning. The AWS walkthrough tests both successful access through its endpoint and failed access from an unconnected VPC; Atlas guidance recommends regular connectivity health checks. (medium confidence) — [source](https://aws.amazon.com/blogs/apn/connecting-applications-securely-to-a-mongodb-atlas-data-plane-with-aws-privatelink/)