MongoDB Atlas Infrastructure as Code

Parent: MongoDB Atlas · researched 2026-05-28T18:34:55.697Z· 28 sources · 30 concepts · skill mongodb-atlas-iac

All Atlas IaC tools call the same cloud.mongodb.com/api/atlas/v2/ endpoints under OAuth 2.0 or HTTP Digest authentication. Tool choice depends on where platform engineering already lives.

Overview

All Atlas IaC tools call the same cloud.mongodb.com/api/atlas/v2/ endpoints under OAuth 2.0 or HTTP Digest authentication. Tool choice depends on where platform engineering already lives. [source]
Current versions (May 2026): [source]
Terraform provider (mongodb/mongodbatlas): v2.12.0 - 72.5M downloads [source]
Atlas Kubernetes Operator (AKO): v2.14 [source]
Atlas CLI: v1.46.x [source]
Atlas Admin API: v2 (v1.0 deprecated) [source]
AWS CloudFormation resources: 33+ resource types [source]
AWS CDK: awscdk-resources-mongodbatlas [source]

Service Accounts (OAuth 2.0) — Recommended (GA April 2025)

Client ID + Client Secret → short-lived bearer tokens (1-hour TTL). Scoped at Organization or Project level. [source]
Why preferred over API Keys: [source]
Industry-standard OAuth 2.0 [source]
Client Secret rotation without changing Client ID [source]
Workload Identity Federation (WIF) - replace static secrets on GKE/AKS/EKS/Cloud Run [source]
Better support in modern Atlas tooling [source]

Programmatic API Keys (HTTP Digest) — Legacy

public_key:private_key pair. Cannot be rotated atomically; counted as "users" in project member list. [source]

Key Migration: v1 → v2 (Breaking Changes)

mongodbatlas_cluster → mongodbatlas_advanced_cluster (provider v2.0) [source]

Drift Detection

Terraform detects drift in terraform plan. Atlas API changes made outside Terraform (via UI or CLI) cause drift. Use terraform import to bring unmanaged resources under Terraform control. [source]

Independent vs Subobject CRDs

Subobject CRDs: Managed as fields in AtlasProject (e.g., spec.alertConfigurations) [source]
Independent CRDs: Deployed as separate Kubernetes objects, can be managed by different teams [source]

Pulumi (MongoDB Atlas Provider)

Parity with Terraform via bridge. Python, Node.js, Go, Java, .NET support. [source]

AWS CloudFormation

33+ MongoDB resource types prefixed MongoDB::Atlas::*. Notable: MongoDB::Atlas::Cluster, MongoDB::Atlas::Project, MongoDB::Atlas::DatabaseUser. [source]
Note: Do NOT use MongoDB::Atlas::FlexCluster - use MongoDB::Atlas::Cluster instead (FlexCluster resource will not receive future updates). [source]

Multi-Environment Patterns

Use Terraform workspaces or separate state files per environment. Never share a single state file across dev/staging/prod. [source]

Common Anti-Patterns

Manual UI changes on Terraform-managed resources: Causes drift; must re-run terraform apply to reconcile [source]
Using legacy mongodbatlas_cluster resource: Removed in provider v2.0; use mongodbatlas_advanced_cluster [source]
Storing Service Account client secrets in Terraform state: Use Vault, AWS Secrets Manager, or external secrets operator [source]
Shared Terraform state across environments: Risk of accidental cross-environment changes [source]
Not pinning provider versions: Atlas IaC tools update frequently; pin to a specific version range [source]

References

Terraform Provider Registry [source]
Atlas Kubernetes Operator GitHub [source]
Atlas Admin API v2 [source]
Atlas Service Accounts [source]

Children

Terraform Atlas Provider v2.x (frontier)
Atlas Kubernetes Operator AKO v2.14 (frontier)
Atlas CLI Scripting (frontier)
Atlas Admin API v2 REST (frontier)
Pulumi mongodbatlas Provider (frontier)
AWS CloudFormation Atlas Resources (frontier)
AWS CDK awscdk-resources-mongodbatlas (frontier)
Service Account OAuth 2.0 Authentication (frontier)
Programmatic API Keys Legacy Auth (frontier)
mongodbatlas_advanced_cluster Resource (frontier)
moved Block Migration Pattern (frontier)
Terraform Drift Detection (frontier)
AKO Independent CRDs (frontier)
AKO Subobject CRDs Deprecated (frontier)
AKO Dry Run Mode (frontier)
AKO Deletion Protection v2.0 (frontier)
AKO Reconciliation Skip Annotation (frontier)
Atlas CLI Terraform Plugin (frontier)
atlas kubernetes config generate (frontier)
Multi-Environment Terraform Directories vs Workspaces (frontier)
Service Account per Environment Pattern (frontier)
Backup Compliance Policy One-Way (frontier)
Atlas IP Access List Ownership Conflict (frontier)
Terraform Import generate-config-out (frontier)
Workload Identity Federation Atlas (frontier)
Atlas Admin API Date Versioned Media Types (frontier)
CloudFormation Third Party Activation (frontier)
Atlas IaC Migration Paths (frontier)
Atlas IaC Anti-Patterns (frontier)
Atlas IaC Tool Decision Matrix (frontier)

Frontier under this node: AKO Deletion Protection v2.0, AKO Dry Run Mode, AKO Independent CRDs, AKO Reconciliation Skip Annotation, AKO Subobject CRDs Deprecated, AWS CDK awscdk-resources-mongodbatlas, AWS CloudFormation Atlas Resources, Atlas Admin API Date Versioned Media Types, Atlas Admin API v2 REST, Atlas CLI Scripting, Atlas CLI Terraform Plugin, Atlas IP Access List Ownership Conflict, Atlas IaC Anti-Patterns, Atlas IaC Migration Paths, Atlas IaC Tool Decision Matrix, Atlas Kubernetes Operator AKO v2.14, Backup Compliance Policy One-Way, CloudFormation Third Party Activation, Multi-Environment Terraform Directories vs Workspaces, Programmatic API Keys Legacy Auth, Pulumi mongodbatlas Provider, Service Account OAuth 2.0 Authentication, Service Account per Environment Pattern, Terraform Atlas Provider v2.x, Terraform Drift Detection, Terraform Import generate-config-out, Workload Identity Federation Atlas, atlas kubernetes config generate, mongodbatlas_advanced_cluster Resource, moved Block Migration Pattern

← the whole tree · 3D view· how to read this page