Network Access Lists

Parent: MongoDB Atlas AWS Networking · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for Network Access Lists; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] The aws_security_group argument is a String representing the unique identifier of the AWS security group to add to the access list, and it is mutually exclusive with cidr_block and ip_address. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/docs/resources/project_ip_access_list.md [source]
[low] The cidr_block argument is a String representing the range of IP addresses in CIDR notation to be added to the access list, and it is mutually exclusive with ip_address and aws_security_group. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/docs/resources/project_ip_access_list.md [source]
[low] The ip_address argument is a String representing a single IP address to be added to the access list, and it is mutually exclusive with cidr_block and aws_security_group. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/docs/resources/project_ip_access_list.md [source]

How it works

[low] When you modify the address of an IP access list entry, the Activity Feed reports two new activities: one for the deletion of the old entry and one for the creation of the new entry. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
[low] A subnet can be associated with only one network ACL at a time, and when you associate a network ACL with a subnet, the previous association is removed. Sources: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html [source]
[low] When you remove an entry from the IP access list, existing connections from the removed addresses may remain open for a variable amount of time. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
[low] During creation, the mongodbatlas_project_ip_access_list resource does not validate whether the specified ip_address, cidr_block, or aws_security_group already exists in the project's access list, and defining a duplicate entry results in a successful resource creation associated to the existing entry. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/docs/resources/project_ip_access_list.md [source]

Problems, failure modes and limitations

[low] You cannot set AWS security groups as temporary access list entries. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
[low] You can't change a permanent IP access list entry to be temporary. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
[low] Network ACLs can't block DNS requests to or from the Route 53 Resolver (also known as the VPC+2 IP address or AmazonProvidedDNS). Sources: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html [source]
[low] Network ACLs can't block traffic to the Instance Metadata Service (IMDS). Sources: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html [source]
[low] You can't modify IP access list entries with the Atlas CLI. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]

Facts and statements

[low] IP access lists set on the Atlas control plane upon provisioning a service account are separate from IP access lists which can be set on the Atlas project data plane for connections to the clusters. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md [source]
[low] If your firewall blocks outbound network connections, you must configure outbound access from your application environment to MongoDB Atlas. Sources: https://www.mongodb.com/docs/atlas/reference/faq/networking.md [source]
[low] We recommend that you permit access to the smallest network segments possible, such as an individual /32 address, and define IP access list entries covering the smallest network segments possible by favoring individual IP addresses and avoiding large CIDR blocks. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md [source]
[low] The IP access list applies to all clusters in the project and can have up to 200 IP access list entries, with the exception that projects with an existing sharded cluster created before August 25, 2017 can have up to 100 IP access list entries. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
[medium] Atlas supports creating temporary IP access list entries that expire within a user-configurable 7-day period, with selectable time periods of 6 hours, 1 day, or 1 week. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md, https://www.mongodb.com/docs/atlas/architecture/current/network-security.md [source]
[low] Atlas does not report updates to an IP access list entry's comment in the Activity Feed. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
[low] Atlas allows access only from the IP addresses and CIDR block IP ranges added to the IP access list and denies application servers and other clients access to clusters if their IP addresses aren't included in the list. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md [source]
[low] mongodbatlas_project_ip_access_list provides an IP Access List entry resource that grants access from IPs, CIDRs, or AWS Security Groups (if VPC Peering is enabled) to clusters within the Project. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/docs/resources/project_ip_access_list.md [source]
[low] We recommend that you configure an IP access list for API keys and programmatic access to allow access only from trusted IP addresses such as your CI/CD pipeline or orchestration system. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md [source]
[low] Use temporary access list entries in situations where team members require access to your environment from temporary work locations or during break-glass scenarios where production access to humans is required to resolve a production-down scenario. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md [source]
[low] Adding an IPv4 /0 CIDR, such as 0.0.0.0/0 or 10.0.0.0/0, to a project access list allows access from anywhere and can expose the deployment to unauthorized access, data exfiltration, and other malicious activity. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
[low] If you add an IPv4 /0 CIDR to a project access list, Atlas sends an alert email to all users directly granted a role to the project or indirectly granted a role through team membership. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]

Related concepts

Access — is a part of Network Access Lists
Network — is a part of Network Access Lists
Lists — is a part of Network Access Lists

Children

No children recorded.

← the whole tree · 3D view· how to read this page