MongoDB Atlas on GCP
Parent: MongoDB Atlas · researched 2026-05-28T17:17:03.280Z· 28 sources · 40 concepts · skill mongodb-atlas-gcp
Deep reference for MongoDB Atlas on Google Cloud Platform covering Private Service Connect (PSC) port-mapped and legacy architectures with Cloud DNS and forwarding rules, GCP IAM and Workload Identity
MongoDB Atlas on GCP — Networking, Integration & Partnership
- Deep reference for MongoDB Atlas on Google Cloud Platform covering Private Service Connect (PSC) port-mapped and legacy architectures with Cloud DNS and forwarding rules, GCP IAM and Workload Identity Federation for Atlas OIDC authentication, Google Cloud KMS BYOK envelope encryption with key rotation and failsafe behavior, GKE + Atlas Kubernetes Operator deployment, Vertex AI + Atlas Vector Search embedding pipelines, BigQuery and Dataflow CDC integration, Cloud Run and Cloud Functions serverless connection patterns, GCP Pub/Sub with Atlas Stream Processing, GCP Marketplace billing, a complete GCP-to-Atlas region mapping table, Terraform IaC patterns, and a GCP-specific troubleshooting playbook. [source]
When to use this skill
- When configuring Atlas Private Service Connect (PSC) on GCP including port-mapped vs legacy architecture, DNS private zones, forwarding rules, and Shared VPC topology [source]
- When setting up GCP IAM / Workload Identity Federation (OIDC) for Atlas database authentication from GCE, GKE, Cloud Run, Cloud Functions, or App Engine [source]
- When implementing Google Cloud KMS as Atlas Encryption at Rest BYOK/CMEK including key rotation workflow and failsafe behavior [source]
- When deploying Atlas Kubernetes Operator (AKO) on GKE and managing CRDs for Atlas resources [source]
- When integrating Atlas Vector Search with Vertex AI embedding pipelines, Agent Engine, or Gemini-backed RAG [source]
- When connecting Cloud Run or Cloud Functions to Atlas and avoiding serverless connection pooling anti-patterns [source]
- When setting up Atlas Stream Processing with Google Cloud Pub/Sub as a sink [source]
- When evaluating GCP Marketplace Atlas billing, EDP commit applicability, or startup credit stacking [source]
- When troubleshooting PSC connectivity, DNS SRV resolution failures, or Cloud KMS access for Atlas [source]
- When looking up the GCP region name → Atlas region identifier mapping for Terraform or API calls [source]
PSC Architecture: Legacy vs Port-Mapped
- Migration from legacy PSC to port-mapped PSC: [source]
- Create new port-mapped endpoint (alongside existing legacy) [source]
- Update application connection strings to use new _psc- prefix [source]
- Remove legacy endpoint and all 50 GCP forwarding rules [source]
- Legacy endpoints must be migrated before April 30, 2027. [source]
DNS for PSC
- PSC uses Cloud DNS private zones. Two options: [source]
- Private DNS zone scoped to VPC (recommended) [source]
- DNS peering from application VPC to the zone where PSC records exist [source]
- For Shared VPC: DNS zone must be in the host project; application projects access via DNS peering. [source]
- SRV DNS requirement: Allow TCP 27017 + high ports (1024-65535) through VPC firewall rules, as SRV records return per-node ports. [source]
OIDC Workload Identity Federation for Atlas
- Atlas supports passwordless authentication using GCP service account tokens. [source]
- Atlas Workload Identity Provider configuration: [source]
- Issuer URI: https://accounts.google.com [source]
- Audience: https://cloud.mongodb.com (or your custom audience if using WIF) [source]
- For GKE Workload Identity: pods use iam.gke.io/gcp-service-account annotation to bind to a GCP service account, which is then mapped to an Atlas database user. [source]
Architecture
Key Rotation
- Enable automatic rotation policy on Cloud KMS key. Use versionless key identifier in Atlas to avoid manual Atlas config updates on rotation. [source]
Failsafe Behavior
- If Cloud KMS becomes inaccessible: running cluster continues (DEK cached in memory), but mongod will NOT restart. Configure alerts for KMS access failures. For multi-region clusters, ensure KMS is accessible from each Atlas-deployed region. [source]
Workload Identity Setup
Embedding Pipeline Architecture
- Atlas Vector Search with Vertex AI is a flagship integration pattern. Supported embedding models: text-embedding-005, text-embedding-004, text-multilingual-embedding-002. [source]
Connection Pooling for Serverless
- Use maxPoolSize: 3-5 for serverless. Cloud Run instances are long-lived - connections persist across requests within the same instance. Cloud Functions are more ephemeral - cold starts create new connections. [source]
- Cloud Run supports minimum instances configuration to keep connections warm (eliminate cold start connection overhead). [source]
BigQuery Data Federation via Atlas Data Federation
- Atlas Data Federation can expose Atlas collections to BigQuery via BigQuery Omni / Federated Queries (limited support; check current status). [source]
Dataflow CDC Integration
8. GCP Pub/Sub + Atlas Stream Processing
- Atlas Stream Processing (ASP) supports GCP Pub/Sub as a source/sink via the Kafka-compatible interface or direct Pub/Sub integration (verify current GA status for direct integration). [source]
9. GCP Marketplace Billing
- Atlas purchases through GCP Marketplace are EDP (Estimated Discount Program) eligible [source]
- GCP startup credits can be stacked with Atlas GCP Marketplace listing [source]
- Pay-As-You-Go available; committed-use discounts via GCP committed use contracts [source]
- GCP Marketplace purchases appear on GCP invoice (not MongoDB invoice) [source]
PSC DNS SRV Resolution Fails
- Verify Cloud DNS private zone exists and is scoped to the correct VPC [source]
- Check that forwarding rules point to the Atlas PSC service attachment [source]
- For GKE pods: verify the pod's VPC has Cloud DNS private zone access (may need DNS peering) [source]
- Confirm firewall rules allow TCP 1024-65535 (SRV high ports) [source]
- Test from within VPC: nslookup _mongodb._tcp.<cluster-hostname> [source]
Cloud KMS Access Denied
- Verify Atlas service account has cloudkms.cryptoKeyVersions.useToEncrypt and useToDecrypt IAM permissions [source]
- Check Cloud KMS key ring is in the same GCP project Atlas is configured for [source]
- Verify key version is not disabled or destroyed [source]
- For multi-region clusters: KMS must be accessible from each Atlas cluster region [source]
Workload Identity Federation Token Errors
- Decode JWT and verify iss claim matches https://accounts.google.com [source]
- Verify aud (audience) matches Atlas Workload IDP configuration [source]
- Check GKE Workload Identity annotation on K8s service account [source]
- Verify GCP IAM binding: roles/iam.workloadIdentityUser on GCP service account [source]
Common Anti-Patterns
- Legacy PSC endpoints not migrated before April 30, 2027 - will be disabled; migrate proactively [source]
- Using GCP VPC peering instead of PSC for new deployments - PSC is more secure (unidirectional trust) [source]
- Cloud Run/Functions with large MongoClient pool - set maxPoolSize: 3-5 to avoid connection floods [source]
- Not setting minimum instances on Cloud Run - cold starts create new Atlas connections; warm instances avoid this [source]
- Using versioned Cloud KMS key identifier - use versionless to enable automatic rotation pickup [source]
See Also
Children
- GCP Private Service Connect (frontier)
- PSC Port-Mapped Architecture (frontier)
- PSC Legacy Migration (frontier)
- GCP VPC Peering (frontier)
- GCP Shared VPC (frontier)
- Cloud DNS Private Zone for Atlas (frontier)
- GCP Global Access PSC (frontier)
- Cloud NAT for Atlas (frontier)
- GCP Workload Identity Federation OIDC (frontier)
- Atlas Admin API GCP Auth (frontier)
- Google Workspace SAML Federation (frontier)
- Google Cloud KMS BYOK (frontier)
- Atlas Envelope Encryption GCP (frontier)
- Cloud HSM Atlas (frontier)
- KMS Key Rotation Atlas (frontier)
- KMS Unavailability Failsafe (frontier)
- GKE Atlas Kubernetes Operator (frontier)
- Cloud Run Atlas Connection Pooling (frontier)
- Cloud Functions Gen2 Atlas (frontier)
- Vertex AI Atlas Vector Search (frontier)
- BigQuery Atlas Dataflow CDC (frontier)
- Atlas Data Federation GCS (frontier)
- Atlas Stream Processing Pub/Sub (frontier)
- Looker Atlas BI Connector (frontier)
- Cloud Monitoring Atlas Metrics (frontier)
- Atlas Audit Logs Cloud Logging (frontier)
- Atlas Alerts Pub/Sub Escalation (frontier)
- GCP Marketplace Atlas Billing (frontier)
- Atlas GCP EDP Credits (frontier)
- GCP Regions Atlas Mapping (frontier)
- Atlas Terraform GCP Provider (frontier)
- PSC Terraform GCP (frontier)
- Cloud DNS Terraform Atlas (frontier)
- Atlas GCP Troubleshooting (frontier)
- GCP Forwarding Rule Quota (frontier)
- GKE NodeLocal DNSCache Atlas (frontier)
- Cloud Build Atlas API Auth (frontier)
- Google Distributed Cloud GDC (frontier)
- Google Cloud Partner of Year (frontier)
- MongoDB for Startups GCP (frontier)
Frontier under this node: Atlas Admin API GCP Auth, Atlas Alerts Pub/Sub Escalation, Atlas Audit Logs Cloud Logging, Atlas Data Federation GCS, Atlas Envelope Encryption GCP, Atlas GCP EDP Credits, Atlas GCP Troubleshooting, Atlas Stream Processing Pub/Sub, Atlas Terraform GCP Provider, BigQuery Atlas Dataflow CDC, Cloud Build Atlas API Auth, Cloud DNS Private Zone for Atlas, Cloud DNS Terraform Atlas, Cloud Functions Gen2 Atlas, Cloud HSM Atlas, Cloud Monitoring Atlas Metrics, Cloud NAT for Atlas, Cloud Run Atlas Connection Pooling, GCP Forwarding Rule Quota, GCP Global Access PSC, GCP Marketplace Atlas Billing, GCP Private Service Connect, GCP Regions Atlas Mapping, GCP Shared VPC, GCP VPC Peering, GCP Workload Identity Federation OIDC, GKE Atlas Kubernetes Operator, GKE NodeLocal DNSCache Atlas, Google Cloud KMS BYOK, Google Cloud Partner of Year, Google Distributed Cloud GDC, Google Workspace SAML Federation, KMS Key Rotation Atlas, KMS Unavailability Failsafe, Looker Atlas BI Connector, MongoDB for Startups GCP, PSC Legacy Migration, PSC Port-Mapped Architecture, PSC Terraform GCP, Vertex AI Atlas Vector Search