Cedar policy authoring for cluster size and autoscaling caps
Parent: Atlas Cost Commitments, Cross-Org Billing and FinOps Tooling · Published reference · snapshot 2026-10-24 · skill mongodb-cohort-047d3a5eff67
↓ Facts as markdownall context files
Source-anchored research for Cedar policy authoring for cluster size and autoscaling caps. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- MongoDB documents this inclusive M30–M60 General-class boundary: forbid(principal, action == ResourcePolicy::Action::"cluster.modify", resource) when { (context.cluster has minGeneralClassInstanceSizeValue && context.cluster.minGeneralClassInstanceSizeValue < 30) || (context.cluster has maxGeneralClassInstanceSizeValue && context.cluster.maxGeneralClassInstanceSizeValue > 60) }; (low confidence) (verified as of 2026-10-18) [source]
How-to and procedures
- Use /orgs/{ORG-ID}/nonCompliantResources to detect existing violations and remediate them; applying a policy does not automatically rewrite pre-existing configurations. The independent Foojay walkthrough demonstrates unchanged but flagged resources. (high confidence) [source]
Problems, failure modes and limitations
- Guard optional attributes before comparing them. Cedar skips policies that error during evaluation; MongoDB’s tier example uses has checks. Whether Atlas adds stricter runtime error handling is not established here. (medium confidence) [source]
Comparisons and alternatives
- The minGeneralClassInstanceSizeValue and maxGeneralClassInstanceSizeValue attributes represent the current tier or the minimum and maximum autoscaling sizes; author against these bounds rather than checking only a desired current tier. (low confidence) (verified as of 2026-10-18) [source]
- Cedar skips policies that error during evaluation. Issue #2428 illustrates incorrect string membership using in, corrected with set.contains(value), and maintainers identify it as invalid unvalidated policy rather than an engine bug. This is a general authoring caution, not evidence of an Atlas exploit. (high confidence) [source]
- A practitioner walkthrough reports successful Terraform deployment and blocked noncompliant requests, but does not demonstrate enforcement of a tier or autoscaling cap. Treat its cap discussion as guidance rather than an independent cap test. (low confidence) (verified as of 2025-08-13) [source]
Facts and statements
- Atlas Resource Policies add organization-wide configuration guardrails to RBAC; project exceptions allow narrower application. Cluster tier caps are a documented cost-control use. (high confidence) (verified as of 2026-10-18) [source]
- MongoDB explicitly excludes Low CPU and NVMe SSD classes from its sample General class tier restriction; do not describe that sample as a universal instance-size cap. (low confidence) (verified as of 2026-10-18) [source]
- Atlas accepts forbid policies, excludes permit statements, and allows role-authorized operations by default. Generic Cedar instead defaults to denial without a matching permit; do not transfer its default directly to Atlas. (high confidence) (verified as of 2026-10-18) [source]
- Existing autoscaling bounds can exceed a newly introduced policy and continue scaling beyond it, although manual scaling beyond the policy is blocked. Inspect /orgs/{ORG-ID}/nonCompliantResources and reconcile existing bounds. (low confidence) (verified as of 2026-10-18) [source]
- Manage resource policies as code with the MongoDB Atlas Terraform provider; an independently authored Foojay walkthrough embeds Cedar bodies in mongodbatlas_resource_policy, while the organization module supports applying policies to existing organizations. (high confidence) [source]
- Upper and lower cluster tier constraints were publicly announced on March 3, 2025 for provisioning, scaling and updates; this dated preview announcement is historical evidence, not a statement of current preview status. (medium confidence) (verified as of 2025-03-03) [source]
- The min/max General-class context values cover the current tier and autoscaling bounds. The example does not constrain Low CPU or NVMe SSD clusters. (low confidence) (verified as of 2026-10-18) [source]
- Terraform can carry Cedar in mongodbatlas_resource_policy policies[].body, with org_id and name. Versioning policies alongside infrastructure enables reviewable, repeatable governance changes. (high confidence) (verified as of 2026-10-18) [source]
Children
- No children recorded.