MongoDB Atlas IAM and RBAC

Parent: MongoDB Atlas · researched 2026-05-28T18:34:34.249Z· 25 sources · 21 concepts · skill mongodb-atlas-iam-rbac

Atlas uses a three-tier identity model: Organization → Project → Database.

Three-Tier Identity Model

Atlas uses a three-tier identity model: Organization → Project → Database. [source]

SCRAM-SHA-256 (default)

Username + password. Most compatible. FIPS 140-2 compliant when using SHA-256. [source]

X.509 Certificates

Client certificate authentication. Two types: [source]
Atlas-managed: Atlas generates and manages the CA; valid for up to 5 years (configurable) [source]
Customer-managed (LDAP): Customer operates their own CA; Atlas validates against customer's CA [source]

AWS IAM (MONGODB-AWS)

Passwordless auth using AWS credentials (IAM user, role, EC2 instance profile, IRSA, Lambda execution role). [source]
Connection string: authMechanism=MONGODB-AWS [source]
Create Atlas database user with username = arn:aws:iam::<account-id>:role/<role-name> or arn:aws:iam::<account-id>:user/<username> [source]

OIDC / Workload Identity Federation (GA 2024)

Workforce (human users) and Workload (apps/services) identity federation. [source]
Workforce OIDC: Human users SSO into Atlas database access via Entra ID, Okta, Google Workspace, or any OIDC provider. [source]
Workload OIDC: Applications authenticate without passwords using OIDC tokens from GCP, Azure, AWS, or any OIDC provider. [source]

LDAP (Deprecated in MongoDB 8.0)

LDAP authentication and authorization supported in MongoDB 4.x–7.x. Deprecated in 8.0. Migrate to OIDC or X.509. [source]

Atlas Service Accounts (GA April 2025)

Replaces legacy Programmatic API Keys for machine-to-machine Atlas API access. [source]
Client ID + Client Secret → OAuth 2.0 client credentials flow → 1-hour bearer tokens [source]
Scoped at Org or Project level [source]
Supports Workload Identity Federation (WIF) - replace Client Secret with OIDC tokens from GKE/AKS/EKS/Cloud Run [source]
Migration from API Keys to Service Accounts: [source]
Create Service Account in Atlas (Org/Project → Access Manager → Service Accounts) [source]
Generate Client ID + Client Secret (show once) [source]
Update IaC/CI env vars: MONGODB_ATLAS_CLIENT_ID + MONGODB_ATLAS_CLIENT_SECRET [source]
Remove old API key after confirming new SA works [source]

Programmatic API Keys (Legacy)

Public key + private key pair using HTTP Digest. Cannot be rotated atomically. Counted as "users" in the project. Will eventually be deprecated. [source]
API key IP allowlist: API keys can be restricted to specific IP addresses - important for CI/CD security. [source]

Workforce Identity Federation (SAML/OIDC)

Allows organization members to log into the Atlas UI and API using their corporate SSO (Okta, Entra ID, Google Workspace, PingFederate). [source]
SAML: Atlas UI access only. Configure via Organization → Security → Federation Management. [source]
OIDC (Workforce): Atlas database access. Configure in Organization → Security → Workforce Identity Provider. Maps IdP group claims to Atlas project roles. [source]
Group-to-role mapping: Map IdP group Object IDs to Atlas org/project roles. Groups claim must be present in the token. Large group membership (>150 groups on Entra ID) may omit groups claim - filter to relevant groups. [source]

Custom Database Roles

Extend built-in MongoDB roles with collection-level or action-level granularity. [source]
Custom roles created at the project level - available across all clusters in the project. [source]

Atlas Resource Policies (Cedar Guardrails)

Atlas Resource Policies use Cedar policy language to enforce organization-wide guardrails (GA 2025). Examples: [source]
Restrict cluster creation to specific cloud providers/regions [source]
Require encryption at rest for all clusters [source]
Enforce minimum backup retention [source]
Applied at the organization level; evaluated before any Atlas API mutation. [source]

Database Auditing

When available: M10+ clusters only. Not available on M0/Flex. [source]
Configure audit log filter to capture: authenticate, authCheck (authorization decisions), createCollection, dropCollection, createDatabase, dropDatabase. [source]
SIEM integration: Push Atlas audit logs to Datadog, Sumo Logic, S3, or via Atlas Admin API log pull. [source]
Activity Feed: Organization and project-level audit trail of Atlas control-plane actions (cluster creates, user changes, backup events) - accessible even on M0/Flex. [source]

Common Debugging Scenarios

"Authentication failed" for new database user: [source]
Verify user exists in the correct project (users are project-scoped) [source]
Verify the auth database is admin for SCRAM users [source]
Verify password does not contain special characters needing URL encoding [source]
Verify IP allowlist includes the client IP [source]
"Authorization failed" after auth succeeds: [source]
Check which roles are assigned to the user [source]
Verify role is scoped to the correct database/collection [source]
Custom roles: check actions and resources are correct [source]
AWS IAM: verify the role ARN matches exactly (account ID + role name) [source]
OIDC token rejected: [source]
Decode JWT: check iss claim matches Atlas Workload IDP issuer config [source]
Check aud claim matches Atlas IDP audience field [source]
Check token exp hasn't passed (clock skew > 5 min causes failures) [source]

References

Atlas Database Users [source]
Atlas Service Accounts [source]
Workforce Identity Federation [source]
Workload Identity Federation [source]
Atlas Resource Policies [source]
Database Auditing [source]

Children

Atlas Three-Tier Identity Model (frontier)
Atlas Organization Roles (frontier)
Atlas Project Roles (15 Purpose-Built) (frontier)
Atlas Database Users (frontier)
Atlas Custom Database Roles (frontier)
Atlas Service Accounts OAuth 2.0 (frontier)
Atlas Programmatic API Keys (Legacy) (frontier)
Atlas Workforce Identity Federation (frontier)
Atlas Workload Identity Federation (frontier)
Atlas AWS IAM Database Auth (frontier)
Atlas X.509 Certificate Auth (frontier)
Atlas LDAPS (Deprecated 8.0) (frontier)
Atlas SCRAM-SHA-256 (frontier)
Atlas Resource Policies Cedar (frontier)
Atlas Database Auditing (frontier)
Atlas Activity Feed (frontier)
Atlas Log Push SIEM (frontier)
Atlas IdP Group to Role Mapping (frontier)
Atlas Organization Teams (frontier)
Atlas Auth Tier Feature Matrix M0 Flex M10 (frontier)
Atlas IAM Compliance Mapping (frontier)

Frontier under this node: Atlas AWS IAM Database Auth, Atlas Activity Feed, Atlas Auth Tier Feature Matrix M0 Flex M10, Atlas Custom Database Roles, Atlas Database Auditing, Atlas Database Users, Atlas IAM Compliance Mapping, Atlas IdP Group to Role Mapping, Atlas LDAPS (Deprecated 8.0), Atlas Log Push SIEM, Atlas Organization Roles, Atlas Organization Teams, Atlas Programmatic API Keys (Legacy), Atlas Project Roles (15 Purpose-Built), Atlas Resource Policies Cedar, Atlas SCRAM-SHA-256, Atlas Service Accounts OAuth 2.0, Atlas Three-Tier Identity Model, Atlas Workforce Identity Federation, Atlas Workload Identity Federation, Atlas X.509 Certificate Auth

← the whole tree · 3D view· how to read this page