MongoDB Atlas AWS Networking

Parent: MongoDB Atlas · researched 2026-05-27T19:53:59.734Z· 10 sources · 18 concepts · skill mongodb-aws-networking

MongoDB Atlas on AWS supports two private networking models: VPC Peering (legacy) and AWS PrivateLink (recommended). Both complement the Network Access List (IP allowlist) for controlling cluster acce

Overview

MongoDB Atlas on AWS supports two private networking models: VPC Peering (legacy) and AWS PrivateLink (recommended). Both complement the Network Access List (IP allowlist) for controlling cluster access. [source]

Private Endpoint Connection String

The private endpoint-aware connection string has a different hostname: [source]
Not the standard mongodb+srv://cluster0.abcde.mongodb.net. [source]

Network Access Lists

Security Groups as access list entries: For applications running in EC2/ECS/Lambda within a VPC, using Security Group IDs as access list entries is more dynamic and avoids managing CIDR ranges. [source]

DNS/SRV Resolution

Atlas uses SRV DNS records (_mongodb._tcp.<hostname>) for cluster discovery. When connecting over PrivateLink, verify: [source]
DNS resolves to private IPs (not public Atlas IPs) [source]
Security groups allow TCP on ports returned by SRV records (typically 1024-65535 for PrivateLink) [source]

Transit Gateway Patterns

For centralized networking with many VPCs: [source]
Create Atlas PrivateLink endpoint in a "hub" VPC [source]
Connect hub VPC to AWS Transit Gateway [source]
All application VPCs access Atlas via Transit Gateway → hub → PrivateLink [source]
Route table: 10.0.0.0/8 → Transit Gateway in spoke VPCs [source]
Transit Gateway also enables cross-account Atlas access without creating separate PrivateLink endpoints per account. [source]

AWS KMS Encryption at Rest (BYOK)

Atlas uses IAM role assumption (not IAM user credentials) to access the KMS key. Configure via Atlas Cloud Provider Access (Unified AWS Access) → creates a cross-account IAM role. [source]
Failsafe: If KMS is inaccessible, running mongod continues (DEK cached in memory) but will not restart. [source]

AWS EventBridge Integration

Route Atlas alert events to EventBridge: [source]
Atlas UI → Integrations → AWS EventBridge → provide AWS account ID [source]
Atlas creates an EventBridge partner event source [source]
Create EventBridge rule to route events to Lambda, SQS, SNS, etc. [source]

AWS ISV Accelerate Partnership

MongoDB is an AWS ISV Accelerate partner: [source]
Co-sell eligibility: MongoDB opportunities can qualify for AWS funding [source]
AWS Marketplace listing for Atlas (PAYG and committed-use) [source]
AWS Marketplace purchases appear on AWS invoice [source]
ISV Workload Migration Program: potential AWS credits for customer migration projects [source]

Common Troubleshooting

Connection timeout after PrivateLink setup: [source]
Verify using the PrivateLink connection string (not standard) [source]
Check security group allows outbound TCP 27017 (or 1024-65535 for SRV) [source]
Verify private_dns_enabled = false on the AWS endpoint [source]
Confirm Atlas private endpoint status = AVAILABLE [source]
DNS resolving to public IP: [source]
Route53 private hosted zone may be interfering [source]
Verify no conflicting private hosted zone for mongodb.net [source]
From EC2 in VPC: nslookup <private-endpoint-hostname> should return private IP [source]
VPC Peering connection not routing: [source]
Route table in application VPC must include route to Atlas VPC CIDR [source]
Route table in Atlas VPC (managed by MongoDB) is auto-updated [source]
CIDR overlap check: Atlas VPC uses 192.168.x.x - ensure no overlap with your VPC [source]

References

Atlas AWS PrivateLink [source]
Atlas VPC Peering [source]
Atlas Unified AWS Access [source]
mongodbatlas Terraform provider [source]

Children

VPC Peering (frontier)
AWS PrivateLink (frontier)
Network Access Lists (frontier)
DNS and SRV Records (frontier)
Multi-Region Networking (frontier)
Transit Gateway Patterns (frontier)
TLS Encryption (frontier)
Security Groups (frontier)
Connection Troubleshooting (frontier)
AWS CloudFormation Atlas (frontier)
Terraform Atlas Provider (frontier)
EventBridge Integration (frontier)
Lambda Integration (frontier)
KMS Encryption at Rest (frontier)
IAM Authentication (frontier)
AWS ISV Accelerate (frontier)
AWS Marketplace Atlas (frontier)
EDP Credits (frontier)

Frontier under this node: AWS CloudFormation Atlas, AWS ISV Accelerate, AWS Marketplace Atlas, AWS PrivateLink, Connection Troubleshooting, DNS and SRV Records, EDP Credits, EventBridge Integration, IAM Authentication, KMS Encryption at Rest, Lambda Integration, Multi-Region Networking, Network Access Lists, Security Groups, TLS Encryption, Terraform Atlas Provider, Transit Gateway Patterns, VPC Peering

← the whole tree · 3D view· how to read this page