MongoDB Atlas on GCP

Parent: MongoDB Atlas · Published reference · snapshot 2026-09-08 · skill mongodb-atlas-expert/references/mongodb-atlas-gcp.md

↓ Facts as markdown all context files

Deep reference for MongoDB Atlas on Google Cloud Platform covering Private Service Connect (PSC) port-mapped and legacy architectures with Cloud DNS and forwarding rules, GCP IAM and Workload Identity

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

MongoDB Atlas on GCP — Networking, Integration & Partnership

Deep reference for MongoDB Atlas on Google Cloud Platform covering Private Service Connect (PSC) port-mapped and legacy architectures with Cloud DNS and forwarding rules, GCP IAM and Workload Identity Federation for Atlas OIDC authentication, Google Cloud KMS BYOK envelope encryption with key rotation and failsafe behavior, GKE + Atlas Kubernetes Operator deployment, Vertex AI + Atlas Vector Search embedding pipelines, BigQuery and Dataflow CDC integration, Cloud Run and Cloud Functions serverless connection patterns, GCP Pub/Sub with Atlas Stream Processing, GCP Marketplace billing, a complete GCP-to-Atlas region mapping table, Terraform IaC patterns, and a GCP-specific troubleshooting playbook. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#mongodb-atlas-on-gcp-networking-integration-partnership]

When to use this skill

When configuring Atlas Private Service Connect (PSC) on GCP including port-mapped vs legacy architecture, DNS private zones, forwarding rules, and Shared VPC topology [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When setting up GCP IAM / Workload Identity Federation (OIDC) for Atlas database authentication from GCE, GKE, Cloud Run, Cloud Functions, or App Engine [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When implementing Google Cloud KMS as Atlas Encryption at Rest BYOK/CMEK including key rotation workflow and failsafe behavior [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When deploying Atlas Kubernetes Operator (AKO) on GKE and managing CRDs for Atlas resources [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When integrating Atlas Vector Search with Vertex AI embedding pipelines, Agent Engine, or Gemini-backed RAG [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When connecting Cloud Run or Cloud Functions to Atlas and avoiding serverless connection pooling anti-patterns [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When setting up Atlas Stream Processing with Google Cloud Pub/Sub as a sink [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When evaluating GCP Marketplace Atlas billing, EDP commit applicability, or startup credit stacking [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When troubleshooting PSC connectivity, DNS SRV resolution failures, or Cloud KMS access for Atlas [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]
When looking up the GCP region name → Atlas region identifier mapping for Terraform or API calls [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#when-to-use-this-skill]

PSC Architecture: Legacy vs Port-Mapped

Migration from legacy PSC to port-mapped PSC: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-architecture-legacy-vs-port-mapped]
- Create new port-mapped endpoint (alongside existing legacy) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-architecture-legacy-vs-port-mapped]
- Update application connection strings to use new _psc- prefix [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-architecture-legacy-vs-port-mapped]
- Remove legacy endpoint and all 50 GCP forwarding rules [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-architecture-legacy-vs-port-mapped]
Legacy endpoints must be migrated before April 30, 2027. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-architecture-legacy-vs-port-mapped]

DNS for PSC

PSC uses Cloud DNS private zones. Two options: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dns-for-psc]
- Private DNS zone scoped to VPC (recommended) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dns-for-psc]
- DNS peering from application VPC to the zone where PSC records exist [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dns-for-psc]
For Shared VPC: DNS zone must be in the host project; application projects access via DNS peering. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dns-for-psc]
SRV DNS requirement: Allow TCP 27017 + high ports (1024-65535) through VPC firewall rules, as SRV records return per-node ports. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dns-for-psc]

OIDC Workload Identity Federation for Atlas

Atlas supports passwordless authentication using GCP service account tokens. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#oidc-workload-identity-federation-for-atlas]
Atlas Workload Identity Provider configuration: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#oidc-workload-identity-federation-for-atlas]
- Issuer URI: https://accounts.google.com [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#oidc-workload-identity-federation-for-atlas]
- Audience: https://cloud.mongodb.com (or your custom audience if using WIF) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#oidc-workload-identity-federation-for-atlas]
For GKE Workload Identity: pods use iam.gke.io/gcp-service-account annotation to bind to a GCP service account, which is then mapped to an Atlas database user. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#oidc-workload-identity-federation-for-atlas]

Architecture

Two-tier encryption: Data Encryption Key (DEK) encrypted by Key Encryption Key (KEK) in Cloud KMS. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#architecture]
Atlas uses symmetric key with cryptoKeyVersions.useToEncrypt and cryptoKeyVersions.useToDecrypt permissions on the Cloud KMS key. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#architecture]

Key Rotation

Enable automatic rotation policy on Cloud KMS key. Use versionless key identifier in Atlas to avoid manual Atlas config updates on rotation. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#key-rotation]

Failsafe Behavior

If Cloud KMS becomes inaccessible: running cluster continues (DEK cached in memory), but mongod will NOT restart. Configure alerts for KMS access failures. For multi-region clusters, ensure KMS is accessible from each Atlas-deployed region. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#failsafe-behavior]

Workload Identity Setup

Enable Workload Identity on GKE cluster [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-setup]
Create GCP service account + IAM binding to Kubernetes service account [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-setup]
Annotate K8s service account with iam.gke.io/gcp-service-account [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-setup]
AKO pod uses Workload Identity for secretless Atlas API access [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-setup]

Embedding Pipeline Architecture

Atlas Vector Search with Vertex AI is a flagship integration pattern. Supported embedding models: text-embedding-005, text-embedding-004, text-multilingual-embedding-002. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#embedding-pipeline-architecture]

Connection Pooling for Serverless

Use maxPoolSize: 3-5 for serverless. Cloud Run instances are long-lived - connections persist across requests within the same instance. Cloud Functions are more ephemeral - cold starts create new connections. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#connection-pooling-for-serverless]
Cloud Run supports minimum instances configuration to keep connections warm (eliminate cold start connection overhead). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#connection-pooling-for-serverless]

BigQuery Data Federation via Atlas Data Federation

Atlas Data Federation can expose Atlas collections to BigQuery via BigQuery Omni / Federated Queries (limited support; check current status). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#bigquery-data-federation-via-atlas-data-federation]

Dataflow CDC Integration

Atlas → Dataflow via Kafka Connector or Change Streams: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dataflow-cdc-integration]
- Configure Kafka Connect source connector against Atlas [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dataflow-cdc-integration]
- Publish change events to Kafka/Pub/Sub [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dataflow-cdc-integration]
- Dataflow reads from Pub/Sub → transforms → writes to BigQuery or Cloud Storage [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#dataflow-cdc-integration]

8. GCP Pub/Sub + Atlas Stream Processing

Atlas Stream Processing (ASP) supports GCP Pub/Sub as a source/sink via the Kafka-compatible interface or direct Pub/Sub integration (verify current GA status for direct integration). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#8-gcp-pubsub-atlas-stream-processing]

9. GCP Marketplace Billing

Atlas purchases through GCP Marketplace are EDP (Estimated Discount Program) eligible [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#9-gcp-marketplace-billing]
GCP startup credits can be stacked with Atlas GCP Marketplace listing [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#9-gcp-marketplace-billing]
Pay-As-You-Go available; committed-use discounts via GCP committed use contracts [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#9-gcp-marketplace-billing]
GCP Marketplace purchases appear on GCP invoice (not MongoDB invoice) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#9-gcp-marketplace-billing]

PSC DNS SRV Resolution Fails

Verify Cloud DNS private zone exists and is scoped to the correct VPC [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-dns-srv-resolution-fails]
Check that forwarding rules point to the Atlas PSC service attachment [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-dns-srv-resolution-fails]
For GKE pods: verify the pod's VPC has Cloud DNS private zone access (may need DNS peering) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-dns-srv-resolution-fails]
Confirm firewall rules allow TCP 1024-65535 (SRV high ports) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-dns-srv-resolution-fails]
Test from within VPC: nslookup _mongodb._tcp.<cluster-hostname> [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#psc-dns-srv-resolution-fails]

Cloud KMS Access Denied

Verify Atlas service account has cloudkms.cryptoKeyVersions.useToEncrypt and useToDecrypt IAM permissions [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#cloud-kms-access-denied]
Check Cloud KMS key ring is in the same GCP project Atlas is configured for [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#cloud-kms-access-denied]
Verify key version is not disabled or destroyed [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#cloud-kms-access-denied]
For multi-region clusters: KMS must be accessible from each Atlas cluster region [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#cloud-kms-access-denied]

Workload Identity Federation Token Errors

Decode JWT and verify iss claim matches https://accounts.google.com [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-federation-token-errors]
Verify aud (audience) matches Atlas Workload IDP configuration [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-federation-token-errors]
Check GKE Workload Identity annotation on K8s service account [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-federation-token-errors]
Verify GCP IAM binding: roles/iam.workloadIdentityUser on GCP service account [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#workload-identity-federation-token-errors]

Common Anti-Patterns

Legacy PSC endpoints not migrated before April 30, 2027 - will be disabled; migrate proactively [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#common-anti-patterns]
Using GCP VPC peering instead of PSC for new deployments - PSC is more secure (unidirectional trust) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#common-anti-patterns]
Cloud Run/Functions with large MongoClient pool - set maxPoolSize: 3-5 to avoid connection floods [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#common-anti-patterns]
Not setting minimum instances on Cloud Run - cold starts create new Atlas connections; warm instances avoid this [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#common-anti-patterns]
Using versioned Cloud KMS key identifier - use versionless to enable automatic rotation pickup [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-gcp/#common-anti-patterns]

Where this helps

Migrating from legacy GCP Private Service Connect endpoints to the current port-mapped PSC architecture ahead of the April 30, 2027 deprecation. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Setting up GCP Workload Identity Federation so GKE, Cloud Run, or Cloud Functions workloads authenticate to Atlas without static credentials. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Building a Vertex AI-backed RAG pipeline against Atlas Vector Search using GCP's text-embedding models. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Sizing MongoDB connection pools correctly for Cloud Run vs. Cloud Functions, which have very different instance-lifetime characteristics. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Project ideas

Migrate a legacy PSC endpoint to the port-mapped architecture, updating connection strings to the _psc- prefix and removing the old GCP forwarding rules afterward. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Set up GKE Workload Identity end-to-end: bind a Kubernetes service account to a GCP service account, annotate it, and map it to an Atlas database user for passwordless auth. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Build a Vertex AI embedding pipeline feeding Atlas Vector Search using one of the supported text-embedding models, such as text-embedding-005. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Configure a Cloud Run service with minimum instances and a small maxPoolSize (3–5) to keep Atlas connections warm and avoid cold-start connection floods. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Common mistakes

Not migrating legacy PSC endpoints before the April 30, 2027 deadline, after which they will be disabled. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Using GCP VPC Peering instead of Private Service Connect for a new deployment, when PSC's unidirectional trust model is the more secure current recommendation. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Running Cloud Run or Cloud Functions with a large default MongoClient connection pool instead of maxPoolSize: 3-5, which can flood Atlas with connections under serverless scaling. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Using a versioned Cloud KMS key identifier in Atlas instead of a versionless one, which prevents automatic pickup of a rotated key. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Known issues

If Cloud KMS becomes inaccessible, a running cluster keeps operating on its cached data encryption key, but mongod will not restart — multi-region clusters need KMS reachable from every deployed region to avoid this. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Cloud Functions are far more ephemeral than Cloud Run instances, so a pooling strategy tuned for one will misbehave on the other — Cloud Functions create new connections on every cold start. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Direct BigQuery integration via Atlas Data Federation (BigQuery Omni / federated queries) has limited support, and current GA status should be verified before depending on it. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
GCP Pub/Sub as a source/sink for Atlas Stream Processing goes through the Kafka-compatible interface, or a not-fully-confirmed direct integration — the current GA status of direct Pub/Sub support needs to be checked before relying on it. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Children

Atlas Admin API GCP Auth
GCP Private Service Connect (frontier, viability 3.20 / 5)
PSC Port-Mapped Architecture (frontier, viability 3.98 / 5)
PSC Legacy Migration (frontier, viability 3.70 / 5)
GCP VPC Peering (frontier, viability 3.63 / 5)
GCP Shared VPC (frontier, viability 3.33 / 5)
Cloud DNS Private Zone for Atlas (frontier, viability 2.77 / 5, below research gate)
GCP Global Access PSC (frontier, viability 3.67 / 5)
Cloud NAT for Atlas (frontier, viability 3.73 / 5)
GCP Workload Identity Federation OIDC (frontier, viability 3.77 / 5)
Google Workspace SAML Federation
Google Cloud KMS BYOK (frontier, viability 3.95 / 5)
Atlas Envelope Encryption GCP
Cloud HSM Atlas
KMS Key Rotation Atlas (frontier, viability 3.80 / 5)
KMS Unavailability Failsafe (frontier, viability 3.83 / 5)
GKE Atlas Kubernetes Operator
Cloud Run Atlas Connection Pooling
Cloud Functions Gen2 Atlas (frontier, viability 3.73 / 5)
Vertex AI Atlas Vector Search
BigQuery Atlas Dataflow CDC (frontier, viability 3.75 / 5)
Atlas Data Federation GCS
Atlas Stream Processing Pub/Sub (frontier, viability 3.50 / 5)
Looker Atlas BI Connector (frontier, viability 3.45 / 5)
Cloud Monitoring Atlas Metrics (frontier, viability 2.88 / 5, below research gate)
Atlas Audit Logs Cloud Logging (frontier, viability 3.27 / 5)
Atlas Alerts Pub/Sub Escalation (frontier, viability 2.88 / 5, below research gate)
GCP Regions Atlas Mapping
Atlas Terraform GCP Provider (frontier, viability 2.67 / 5, below research gate)
PSC Terraform GCP (frontier, viability 3.95 / 5)
Cloud DNS Terraform Atlas (frontier, viability 2.35 / 5, below research gate)
Atlas GCP Troubleshooting (frontier, viability 2.60 / 5, below research gate)
GCP Forwarding Rule Quota (frontier, viability 3.75 / 5)
GKE NodeLocal DNSCache Atlas
Cloud Build Atlas API Auth
Google Distributed Cloud GDC
Google Cloud Partner of Year (frontier, viability 1.40 / 5, below research gate)
MongoDB for Startups GCP (frontier, viability 2.00 / 5, below research gate)
Atlas Billing Mechanics and Cost Visibility

Frontier under this node: Atlas Alerts Pub/Sub Escalation (2.88), Atlas Audit Logs Cloud Logging (3.27), Atlas GCP EDP Credits, Atlas GCP Troubleshooting (2.60), Atlas Stream Processing Pub/Sub (3.50), Atlas Terraform GCP Provider (2.67), BigQuery Atlas Dataflow CDC (3.75), Cloud DNS Private Zone for Atlas (2.77), Cloud DNS Terraform Atlas (2.35), Cloud Functions Gen2 Atlas (3.73), Cloud Monitoring Atlas Metrics (2.88), Cloud NAT for Atlas (3.73), GCP Forwarding Rule Quota (3.75), GCP Global Access PSC (3.67), GCP Marketplace Atlas Billing, GCP Private Service Connect (3.20), GCP Shared VPC (3.33), GCP VPC Peering (3.63), GCP Workload Identity Federation OIDC (3.77), Google Cloud KMS BYOK (3.95), Google Cloud Partner of Year (1.40), KMS Key Rotation Atlas (3.80), KMS Unavailability Failsafe (3.83), Looker Atlas BI Connector (3.45), MongoDB for Startups GCP (2.00), PSC Legacy Migration (3.70), PSC Port-Mapped Architecture (3.98), PSC Terraform GCP (3.95)

← the whole tree · 3D view· how to read this page