Security Groups
Parent: MongoDB Atlas AWS Networking · Published reference · snapshot 2026-10-15 · viability 3.45 / 5 (research)
↓ Facts as markdownall context files
Depth-first rabbithole dossier for Security Groups; source-anchored research pack.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Definitions
- [low] Security groups are stateful, which means that information about previously sent or received traffic is saved. Sources: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html [source]
How it works
- [low] In order to use AWS Security Group(s), VPC Peering must be enabled. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/blob/master/docs/resources/project_ip_access_list.md [source]
- [low] If you route traffic between two instances in different subnets through a middlebox appliance and reference the security group of the other instance as the source, this does not allow traffic to flow between the instances; reference the other instance's private IP address or its subnet CIDR range instead. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html [source]
- [low] When a security group rule becomes stale, it's not automatically removed from your security group—you must manually remove it. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html [source]
- [low] If a security group rule is stale because the VPC peering connection was deleted, the rule will no longer be marked as stale if you create a new VPC peering connection with the same VPCs. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html [source]
Problems, failure modes and limitations
- [low] You can't reference the security group of a peer VPC that's in a different Region; instead, use the CIDR block of the peer VPC. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html [source]
Facts and statements
- [low] Atlas does not support adding AWS security groups to IP access lists in projects with VPC peering connections in multiple regions. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
- [low] For AWS security groups, Atlas configures the IP access list entry for every container provisioned in the project for the listed regions, but not for any other containers. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
- [low] For AWS clusters with VPC peering connections to the same region, you can specify a Security Group associated with the peer VPC. Sources: https://www.mongodb.com/docs/atlas/security/ip-access-list.md [source]
- [low] Create a network traffic rule on your AWS security group attached to resources connecting to Atlas to allow outbound traffic on ports 27015-27017 inclusive to your Atlas CIDR. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md [source]
- [low] To reference a security group in a peer VPC, the VPC peering connection must be in the active state. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html [source]
- [low] For a peer VPC in a different account but the same Region, enter the account ID and security group ID, separated by a forward slash (for example, 123456789012/sg-1a2b3c4d). Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html [source]
- [low] If the VPC peering connection is deleted, or if the owner of the peer VPC deletes the referenced security group, the security group rule becomes stale. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html [source]
Related concepts
- Security — is a part of Security Groups
- Groups — is a part of Security Groups
Children
- No children recorded.