MongoDB Security Architecture

Parent: MongoDB Expert Knowledge · researched 2026-05-28T18:37:04.905Z· 24 sources · 10 concepts · skill mongodb-security-architecture

```

TLS Requirements

Atlas enforces TLS 1.2+ by default. For self-managed: [source]

Network Access Controls

IP Allowlist: CIDR-based ingress control [source]
Private Endpoints (AWS PrivateLink / Azure Private Link / GCP PSC): recommended [source]
Security Groups (AWS): alternative to IP allowlist [source]
Block public access: enforce private endpoint only [source]
net.bindIp: restrict mongod to specific interfaces [source]
OS firewall: allow only required ports (27017 for mongod, 27018 for shards, 27019 for config) [source]
VPC security groups / network ACLs [source]

Built-in Role Hierarchy

Principle of Least Privilege: Each application component gets only the minimum roles needed. [source]

Encryption at Rest

Atlas: Default AES-256 encryption at rest using MongoDB-managed keys. For BYOK (Customer Key Management): [source]

Encryption in Transit

All client connections: TLS 1.2+. [source]
Internal replication traffic: TLS optional on self-managed (required on Atlas). [source]

Field-Level Encryption (CSFLE / Queryable Encryption)

For sensitive fields that must be encrypted even from DBA access: [source]
CSFLE: Deterministic (queryable for equality) or Random (not queryable) [source]
Queryable Encryption (7.0+): Equality + Range queries on encrypted fields [source]
See mongodb-encryption for complete implementation guide. [source]

SIEM Integration

Route Atlas audit logs to SIEM: [source]
AWS Security Hub: Atlas → S3 → AWS Security Hub [source]
Splunk: Splunk Universal Forwarder → Atlas log pull API [source]
Microsoft Sentinel: MongoDB Atlas Data Connector in Sentinel Content Hub [source]
Datadog: MongoDB Atlas Datadog integration [source]

Secrets Manager Integration

AWS: Store MONGODB_URI in AWS Secrets Manager; use Lambda environment variable injection [source]
Azure: Store in Azure Key Vault; inject via Managed Identity or App Configuration [source]
GCP: Store in Secret Manager; inject via Workload Identity [source]
HashiCorp Vault: MongoDB dynamic credentials plugin creates time-limited Atlas API keys [source]

Atlas

[ ] Enable MFA on all Atlas users [source]
[ ] Use Service Accounts instead of API Keys for programmatic access [source]
[ ] Configure IP allowlist with minimum required IPs (or private endpoints) [source]
[ ] Enable "Block Public Access" (private endpoint only) [source]
[ ] Enable encryption at rest (default) or BYOK for compliance [source]
[ ] Enable database auditing (M10+) [source]
[ ] Use principle of least privilege for database users [source]
[ ] Enable Atlas Backup Compliance Policy (for regulated workloads) [source]
[ ] Configure Atlas resource policies (org-level guardrails) [source]

Self-Managed

[ ] Enable authentication (security.authorization: enabled) [source]
[ ] Disable localhost exception after creating first user [source]
[ ] Enable TLS for all connections [source]
[ ] Bind mongod to specific interfaces (net.bindIp) [source]
[ ] Disable server-side JavaScript if not needed (security.javascriptEnabled: false) [source]
[ ] Enable audit logging for compliance [source]
[ ] Rotate credentials on schedule [source]
[ ] Apply OS-level firewall rules [source]
[ ] Run mongod as non-root OS user [source]

Common Security Anti-Patterns

0.0.0.0/0 in Atlas IP allowlist: Opens cluster to the internet; never use in production [source]
atlasAdmin or root role for application users: Applications should never have admin roles; use read/readWrite scoped to their databases [source]
Storing MongoDB credentials in application code or git: Use secrets manager or environment variables [source]
Not enabling MFA: Single-factor Atlas UI access is a security gap for admin accounts [source]
X.509 certificates without a CA: Self-signed certs without a CA make certificate rotation extremely painful [source]
Not rotating credentials: Leaked credentials remain valid indefinitely without rotation policies [source]

References

MongoDB Security Architecture [source]
Atlas Security Overview [source]
Atlas Database Auditing [source]
MongoDB Encryption at Rest [source]
OIDC Authentication [source]

Children

Authentication Methods (frontier)
Atlas RBAC (frontier)
Network Security Layers (frontier)
Atlas Audit Logging (frontier)
Self-Managed Security Config (frontier)
Org and Project Governance (frontier)
Encryption in Transit (frontier)
Secrets Management (frontier)
Atlas Security Posture Checklist (frontier)

Frontier under this node: Atlas Audit Logging, Atlas RBAC, Atlas Security Posture Checklist, Authentication Methods, Encryption in Transit, Network Security Layers, Org and Project Governance, Secrets Management, Self-Managed Security Config

← the whole tree · 3D view· how to read this page