MongoDB Security Architecture

Parent: MongoDB Expert Knowledge · Published reference · snapshot 2026-09-08 · skill mongodb-operations-expert/references/mongodb-security-architecture.md

↓ Facts as markdown all context files

```

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

TLS Requirements

Atlas enforces TLS 1.2+ by default. For self-managed: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#tls-requirements]

Network Access Controls

IP Allowlist: CIDR-based ingress control [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
Private Endpoints (AWS PrivateLink / Azure Private Link / GCP PSC): recommended [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
Security Groups (AWS): alternative to IP allowlist [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
Block public access: enforce private endpoint only [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
net.bindIp: restrict mongod to specific interfaces [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
OS firewall: allow only required ports (27017 for mongod, 27018 for shards, 27019 for config) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
VPC security groups / network ACLs [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]

Built-in Role Hierarchy

Principle of Least Privilege: Each application component gets only the minimum roles needed. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#built-in-role-hierarchy]

Encryption at Rest

Atlas: Default AES-256 encryption at rest using MongoDB-managed keys. For BYOK (Customer Key Management): [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#encryption-at-rest]

Encryption in Transit

All client connections: TLS 1.2+. Internal replication traffic: TLS optional on self-managed (required on Atlas). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#encryption-in-transit]

Field-Level Encryption (CSFLE / Queryable Encryption)

For sensitive fields that must be encrypted even from DBA access: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]
- CSFLE: Deterministic (queryable for equality) or Random (not queryable) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]
- Queryable Encryption (7.0+): Equality + Range queries on encrypted fields [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]
See mongodb-encryption for complete implementation guide. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]

SIEM Integration

Route Atlas audit logs to SIEM: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- AWS Security Hub: Atlas → S3 → AWS Security Hub [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- Splunk: Splunk Universal Forwarder → Atlas log pull API [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- Microsoft Sentinel: MongoDB Atlas Data Connector in Sentinel Content Hub [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- Datadog: MongoDB Atlas Datadog integration [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]

Secrets Manager Integration

AWS: Store MONGODB_URI in AWS Secrets Manager; use Lambda environment variable injection [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]
Azure: Store in Azure Key Vault; inject via Managed Identity or App Configuration [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]
GCP: Store in Secret Manager; inject via Workload Identity [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]
HashiCorp Vault: MongoDB dynamic credentials plugin creates time-limited Atlas API keys [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]

Atlas

[ ] Enable MFA on all Atlas users [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Use Service Accounts instead of API Keys for programmatic access [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Configure IP allowlist with minimum required IPs (or private endpoints) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable "Block Public Access" (private endpoint only) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable encryption at rest (default) or BYOK for compliance [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable database auditing (M10+) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Use principle of least privilege for database users [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable Atlas Backup Compliance Policy (for regulated workloads) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Configure Atlas resource policies (org-level guardrails) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]

Self-Managed

[ ] Enable authentication (security.authorization: enabled) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Disable localhost exception after creating first user [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Enable TLS for all connections [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Bind mongod to specific interfaces (net.bindIp) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Disable server-side JavaScript if not needed (security.javascriptEnabled: false) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Enable audit logging for compliance [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Rotate credentials on schedule [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Apply OS-level firewall rules [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Run mongod as non-root OS user [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]

Common Security Anti-Patterns

0.0.0.0/0 in Atlas IP allowlist: Opens cluster to the internet; never use in production [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
atlasAdmin or root role for application users: Applications should never have admin roles; use read/readWrite scoped to their databases [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
Storing MongoDB credentials in application code or git: Use secrets manager or environment variables [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
Not enabling MFA: Single-factor Atlas UI access is a security gap for admin accounts [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
X.509 certificates without a CA: Self-signed certs without a CA make certificate rotation extremely painful [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
Not rotating credentials: Leaked credentials remain valid indefinitely without rotation policies [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]

References

MongoDB Security Architecture [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
Atlas Security Overview [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
Atlas Database Auditing [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
MongoDB Encryption at Rest [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
OIDC Authentication [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]

Where this helps

Hardening a new Atlas or self-managed MongoDB deployment before it goes into production, working through the Atlas and self-managed security checklists item by item. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Deciding how to protect specific sensitive fields (PII, financial data) from even database-administrator-level access, choosing between CSFLE and Queryable Encryption. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Wiring MongoDB audit logs into an existing SIEM (Splunk, Sentinel, Security Hub, Datadog) as part of a broader security-monitoring program. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Setting up secrets management for database credentials so they never end up hard-coded in application code or committed to git. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

How to apply this

Work through the Atlas or self-managed security checklist as a pre-launch gate — MFA, least-privilege roles, IP allowlist or private endpoints, encryption at rest, and audit logging all need explicit configuration, not just defaults. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Route database credentials through a secrets manager (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, or HashiCorp Vault's dynamic-credentials plugin) instead of environment files or hard-coded connection strings. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Scope every application's database user to the minimum roles it actually needs (read/readWrite on specific databases), never atlasAdmin or root, following the principle of least privilege. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Choose CSFLE when a field only needs deterministic equality queries and Queryable Encryption (7.0+) when it needs equality plus range queries, both keeping the field unreadable to database administrators. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Common mistakes

Leaving 0.0.0.0/0 in the Atlas IP allowlist, which opens the cluster to the entire internet and should never appear in a production configuration. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Granting atlasAdmin or root roles to application database users instead of scoping them to read/readWrite on their specific databases. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Storing MongoDB credentials directly in application code or committing them to git instead of using a secrets manager or injected environment variables. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Using self-signed X.509 certificates without a proper CA, which makes certificate rotation extremely painful down the line. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Known issues

Internal replication traffic is TLS-optional on self-managed deployments but required on Atlas, so a self-managed cluster can be quietly running unencrypted intra-cluster traffic even with client-facing TLS enabled. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
The localhost exception (unauthenticated access before the first user is created) must be explicitly disabled after setup, or a self-managed deployment can remain open longer than intended. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Database auditing on Atlas is only available on M10+ dedicated clusters, so shared-tier deployments have no built-in audit-logging option at all. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Field-Level Encryption protects specific fields from DBA-level access, but it's a distinct implementation project on top of baseline TLS and RBAC — standard encryption at rest and in transit does not by itself protect fields from administrator visibility. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Children

Authentication Methods (frontier, viability 3.65 / 5)
Atlas RBAC (frontier, viability 3.55 / 5)
Network Security Layers (frontier, viability 2.98 / 5, below research gate)
Atlas Audit Logging (frontier, viability 3.55 / 5)
Self-Managed Security Config (frontier, viability 3.80 / 5)
Org and Project Governance (frontier, viability 4.25 / 5)
Encryption in Transit (frontier)
Secrets Management (frontier, viability 3.95 / 5)
Atlas Security Posture Checklist (frontier, viability 3.65 / 5)

Frontier under this node: Atlas Audit Logging (3.55), Atlas RBAC (3.55), Atlas Security Posture Checklist (3.65), Authentication Methods (3.65), Encryption in Transit, Network Security Layers (2.98), Org and Project Governance (4.25), Secrets Management (3.95), Self-Managed Security Config (3.80)

← the whole tree · 3D view· how to read this page