MongoDB Atlas AWS Networking
Parent: MongoDB Atlas · Published reference · snapshot 2026-09-08 · skill mongodb-atlas-expert/references/mongodb-aws-networking.md
↓ Facts as markdownall context files
MongoDB Atlas on AWS supports two private networking models: VPC Peering (legacy) and AWS PrivateLink (recommended). Both complement the Network Access List (IP allowlist) for controlling cluster acce
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Overview
- MongoDB Atlas on AWS supports two private networking models: VPC Peering (legacy) and AWS PrivateLink (recommended). Both complement the Network Access List (IP allowlist) for controlling cluster access. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#overview]
Private Endpoint Connection String
- The private endpoint-aware connection string has a different hostname: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#private-endpoint-connection-string]
- Not the standard mongodb+srv://cluster0.abcde.mongodb.net. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#private-endpoint-connection-string]
Network Access Lists
- Security Groups as access list entries: For applications running in EC2/ECS/Lambda within a VPC, using Security Group IDs as access list entries is more dynamic and avoids managing CIDR ranges. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#network-access-lists]
DNS/SRV Resolution
- Atlas uses SRV DNS records (_mongodb._tcp.<hostname>) for cluster discovery. When connecting over PrivateLink, verify: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#dnssrv-resolution]
- DNS resolves to private IPs (not public Atlas IPs) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#dnssrv-resolution]
- Security groups allow TCP on ports returned by SRV records (typically 1024-65535 for PrivateLink) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#dnssrv-resolution]
Transit Gateway Patterns
- For centralized networking with many VPCs: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#transit-gateway-patterns]
- Create Atlas PrivateLink endpoint in a "hub" VPC [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#transit-gateway-patterns]
- Connect hub VPC to AWS Transit Gateway [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#transit-gateway-patterns]
- All application VPCs access Atlas via Transit Gateway → hub → PrivateLink [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#transit-gateway-patterns]
- Route table: 10.0.0.0/8 → Transit Gateway in spoke VPCs [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#transit-gateway-patterns]
- Transit Gateway also enables cross-account Atlas access without creating separate PrivateLink endpoints per account. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#transit-gateway-patterns]
AWS KMS Encryption at Rest (BYOK)
- Atlas uses IAM role assumption (not IAM user credentials) to access the KMS key. Configure via Atlas Cloud Provider Access (Unified AWS Access) → creates a cross-account IAM role. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-kms-encryption-at-rest-byok]
- Failsafe: If KMS is inaccessible, running mongod continues (DEK cached in memory) but will not restart. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-kms-encryption-at-rest-byok]
AWS EventBridge Integration
- Route Atlas alert events to EventBridge: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-eventbridge-integration]
- Atlas UI → Integrations → AWS EventBridge → provide AWS account ID [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-eventbridge-integration]
- Atlas creates an EventBridge partner event source [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-eventbridge-integration]
- Create EventBridge rule to route events to Lambda, SQS, SNS, etc. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-eventbridge-integration]
AWS ISV Accelerate Partnership
- MongoDB is an AWS ISV Accelerate partner: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-isv-accelerate-partnership]
- Co-sell eligibility: MongoDB opportunities can qualify for AWS funding [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-isv-accelerate-partnership]
- AWS Marketplace listing for Atlas (PAYG and committed-use) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-isv-accelerate-partnership]
- AWS Marketplace purchases appear on AWS invoice [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-isv-accelerate-partnership]
- ISV Workload Migration Program: potential AWS credits for customer migration projects [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#aws-isv-accelerate-partnership]
Common Troubleshooting
- Connection timeout after PrivateLink setup: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Verify using the PrivateLink connection string (not standard) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Check security group allows outbound TCP 27017 (or 1024-65535 for SRV) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Verify private_dns_enabled = false on the AWS endpoint [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Confirm Atlas private endpoint status = AVAILABLE [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- DNS resolving to public IP: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Route53 private hosted zone may be interfering [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Verify no conflicting private hosted zone for mongodb.net [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- From EC2 in VPC: nslookup <private-endpoint-hostname> should return private IP [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- VPC Peering connection not routing: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Route table in application VPC must include route to Atlas VPC CIDR [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- Route table in Atlas VPC (managed by MongoDB) is auto-updated [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
- CIDR overlap check: Atlas VPC uses 192.168.x.x - ensure no overlap with your VPC [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#common-troubleshooting]
References
- Atlas AWS PrivateLink [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#references]
- Atlas VPC Peering [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#references]
- Atlas Unified AWS Access [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#references]
- mongodbatlas Terraform provider [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-aws-networking/#references]
Where this helps
- Choosing between AWS PrivateLink and legacy VPC Peering when designing private connectivity from an application VPC to an Atlas cluster. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Debugging a connection timeout that appears only after switching to a PrivateLink connection string. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Designing centralized network access for many application VPCs, or cross-account access, using AWS Transit Gateway in front of a single PrivateLink endpoint. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Setting up AWS KMS-backed encryption at rest (BYOK) for an Atlas cluster and understanding what happens if Atlas loses access to the key. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Project ideas
- Stand up an Atlas PrivateLink endpoint from a hub VPC and route several spoke VPCs to it through AWS Transit Gateway, instead of provisioning one PrivateLink endpoint per VPC. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Configure Security Group IDs, instead of static CIDR ranges, as Atlas Network Access List entries for an app running in ECS or Lambda inside a VPC. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Wire Atlas alert events into AWS EventBridge and route them to a Lambda function or SNS topic for custom on-call automation. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Set up AWS KMS BYOK for an Atlas cluster via Cloud Provider Access (Unified AWS Access) and verify the cross-account IAM role Atlas assumes. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Antipatterns
- Using the standard mongodb+srv:// connection string after setting up PrivateLink instead of the private-endpoint-aware connection string, which quietly resolves to public Atlas IPs. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Restricting security groups to port 27017 only, when SRV-based connection strings return additional high ports (typically 1024–65535) that must also be allowed. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Assuming Atlas VPC Peering route tables update automatically on both sides — only the Atlas-managed VPC's route table auto-updates; your application VPC's route table needs the route added manually. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Not checking for CIDR overlap with Atlas's VPC (192.168.x.x) before setting up VPC Peering, which silently breaks routing. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Known issues
- A private hosted zone for mongodb.net in Route 53 can interfere with DNS resolution and cause it to resolve to a public IP even when PrivateLink is configured correctly. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Transit Gateway centralization adds a routing hop and a dependency on the hub VPC's PrivateLink endpoint staying healthy for every spoke VPC behind it. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Cloud Provider Access for AWS KMS BYOK uses IAM role assumption, not static credentials, so any change to the cross-account role or its trust policy can silently break encryption-key access. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- The AWS ISV Accelerate and Marketplace co-sell benefits are partnership-program details that can change independently of the technical networking guidance in this pack. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Children
- VPC Peering (frontier)
- AWS PrivateLink
- Network Access Lists (frontier)
- DNS and SRV Records (frontier)
- Multi-Region Networking (frontier)
- Transit Gateway Patterns (frontier)
- TLS Encryption (frontier)
- Security Groups (frontier)
- Connection Troubleshooting (frontier)
- AWS CloudFormation Atlas
- Terraform Atlas Provider (frontier)
- EventBridge Integration (frontier)
- Lambda Integration (frontier)
- KMS Encryption at Rest (frontier)
- IAM Authentication (frontier)
- AWS ISV Accelerate
- AWS Marketplace Atlas
- EDP Credits (frontier)
Frontier under this node: Connection Troubleshooting, DNS and SRV Records, EDP Credits, EventBridge Integration, IAM Authentication, KMS Encryption at Rest, Lambda Integration, Multi-Region Networking, Network Access Lists, Security Groups, TLS Encryption, Terraform Atlas Provider, Transit Gateway Patterns, VPC Peering