MongoDB Security Architecture

Parent: MongoDB Expert Knowledge · Published reference · snapshot 2026-09-08 · skill mongodb-operations-expert/references/mongodb-security-architecture.md

↓ Facts as markdown all context files

```

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

TLS Requirements

Atlas enforces TLS 1.2+ by default. For self-managed: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#tls-requirements]

Network Access Controls

IP Allowlist: CIDR-based ingress control [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
Private Endpoints (AWS PrivateLink / Azure Private Link / GCP PSC): recommended [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
Security Groups (AWS): alternative to IP allowlist [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
Block public access: enforce private endpoint only [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
net.bindIp: restrict mongod to specific interfaces [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
OS firewall: allow only required ports (27017 for mongod, 27018 for shards, 27019 for config) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]
VPC security groups / network ACLs [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#network-access-controls]

Built-in Role Hierarchy

Principle of Least Privilege: Each application component gets only the minimum roles needed. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#built-in-role-hierarchy]

Encryption at Rest

Atlas: Default AES-256 encryption at rest using MongoDB-managed keys. For BYOK (Customer Key Management): [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#encryption-at-rest]

Encryption in Transit

All client connections: TLS 1.2+. Internal replication traffic: TLS optional on self-managed (required on Atlas). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#encryption-in-transit]

Field-Level Encryption (CSFLE / Queryable Encryption)

For sensitive fields that must be encrypted even from DBA access: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]
- CSFLE: Deterministic (queryable for equality) or Random (not queryable) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]
- Queryable Encryption (7.0+): Equality + Range queries on encrypted fields [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]
See mongodb-encryption for complete implementation guide. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#field-level-encryption-csfle-queryable-encryption]

SIEM Integration

Route Atlas audit logs to SIEM: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- AWS Security Hub: Atlas → S3 → AWS Security Hub [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- Splunk: Splunk Universal Forwarder → Atlas log pull API [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- Microsoft Sentinel: MongoDB Atlas Data Connector in Sentinel Content Hub [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]
- Datadog: MongoDB Atlas Datadog integration [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#siem-integration]

Secrets Manager Integration

AWS: Store MONGODB_URI in AWS Secrets Manager; use Lambda environment variable injection [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]
Azure: Store in Azure Key Vault; inject via Managed Identity or App Configuration [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]
GCP: Store in Secret Manager; inject via Workload Identity [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]
HashiCorp Vault: MongoDB dynamic credentials plugin creates time-limited Atlas API keys [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#secrets-manager-integration]

Atlas

[ ] Enable MFA on all Atlas users [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Use Service Accounts instead of API Keys for programmatic access [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Configure IP allowlist with minimum required IPs (or private endpoints) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable "Block Public Access" (private endpoint only) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable encryption at rest (default) or BYOK for compliance [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable database auditing (M10+) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Use principle of least privilege for database users [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Enable Atlas Backup Compliance Policy (for regulated workloads) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]
[ ] Configure Atlas resource policies (org-level guardrails) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#atlas]

Self-Managed

[ ] Enable authentication (security.authorization: enabled) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Disable localhost exception after creating first user [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Enable TLS for all connections [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Bind mongod to specific interfaces (net.bindIp) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Disable server-side JavaScript if not needed (security.javascriptEnabled: false) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Enable audit logging for compliance [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Rotate credentials on schedule [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Apply OS-level firewall rules [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]
[ ] Run mongod as non-root OS user [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#self-managed]

Common Security Anti-Patterns

0.0.0.0/0 in Atlas IP allowlist: Opens cluster to the internet; never use in production [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
atlasAdmin or root role for application users: Applications should never have admin roles; use read/readWrite scoped to their databases [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
Storing MongoDB credentials in application code or git: Use secrets manager or environment variables [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
Not enabling MFA: Single-factor Atlas UI access is a security gap for admin accounts [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
X.509 certificates without a CA: Self-signed certs without a CA make certificate rotation extremely painful [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]
Not rotating credentials: Leaked credentials remain valid indefinitely without rotation policies [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#common-security-anti-patterns]

References

MongoDB Security Architecture [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
Atlas Security Overview [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
Atlas Database Auditing [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
MongoDB Encryption at Rest [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]
OIDC Authentication [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-security-architecture/#references]

Where this helps

Hardening a new Atlas or self-managed MongoDB deployment before it goes into production, working through the Atlas and self-managed security checklists item by item. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Deciding how to protect specific sensitive fields (PII, financial data) from even database-administrator-level access, choosing between CSFLE and Queryable Encryption. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Wiring MongoDB audit logs into an existing SIEM (Splunk, Sentinel, Security Hub, Datadog) as part of a broader security-monitoring program. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Setting up secrets management for database credentials so they never end up hard-coded in application code or committed to git. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

How to apply this

Work through the Atlas or self-managed security checklist as a pre-launch gate — MFA, least-privilege roles, IP allowlist or private endpoints, encryption at rest, and audit logging all need explicit configuration, not just defaults. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Route database credentials through a secrets manager (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, or HashiCorp Vault's dynamic-credentials plugin) instead of environment files or hard-coded connection strings. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Scope every application's database user to the minimum roles it actually needs (read/readWrite on specific databases), never atlasAdmin or root, following the principle of least privilege. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Choose CSFLE when a field only needs deterministic equality queries and Queryable Encryption (7.0+) when it needs equality plus range queries, both keeping the field unreadable to database administrators. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Common mistakes

Leaving 0.0.0.0/0 in the Atlas IP allowlist, which opens the cluster to the entire internet and should never appear in a production configuration. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Granting atlasAdmin or root roles to application database users instead of scoping them to read/readWrite on their specific databases. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Storing MongoDB credentials directly in application code or committing them to git instead of using a secrets manager or injected environment variables. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Using self-signed X.509 certificates without a proper CA, which makes certificate rotation extremely painful down the line. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Known issues

Internal replication traffic is TLS-optional on self-managed deployments but required on Atlas, so a self-managed cluster can be quietly running unencrypted intra-cluster traffic even with client-facing TLS enabled. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
The localhost exception (unauthenticated access before the first user is created) must be explicitly disabled after setup, or a self-managed deployment can remain open longer than intended. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Database auditing on Atlas is only available on M10+ dedicated clusters, so shared-tier deployments have no built-in audit-logging option at all. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Field-Level Encryption protects specific fields from DBA-level access, but it's a distinct implementation project on top of baseline TLS and RBAC — standard encryption at rest and in transit does not by itself protect fields from administrator visibility. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Children

Authentication Methods (frontier, viability 3.65 / 5)
Atlas RBAC (frontier, viability 3.55 / 5)
Network Security Layers (frontier, viability 2.98 / 5, below research gate)
Atlas Audit Logging (frontier, viability 3.55 / 5)
Self-Managed Security Config (frontier, viability 3.80 / 5)
Org and Project Governance (frontier, viability 4.25 / 5)
Encryption in Transit (frontier)
Secrets Management (frontier, viability 3.95 / 5)
Atlas Security Posture Checklist (frontier, viability 3.65 / 5)
Queryable Encryption prefix, suffix and substring query configuration (frontier, viability 4.65 / 5)
Client-side encryption DEK rewrapping with rewrapManyDataKey (frontier, viability 4.50 / 5)
Queryable Encryption ESC/ECOC metadata compaction and leakage tradeoffs (frontier, viability 4.50 / 5)
Queryable Encryption contention and range-index tuning (frontier, viability 4.25 / 5)

Frontier under this node: Atlas Audit Logging (3.55), Atlas RBAC (3.55), Atlas Security Posture Checklist (3.65), Authentication Methods (3.65), Client-side encryption DEK rewrapping with rewrapManyDataKey (4.50), Encryption in Transit, Network Security Layers (2.98), Org and Project Governance (4.25), Queryable Encryption ESC/ECOC metadata compaction and leakage tradeoffs (4.50), Queryable Encryption contention and range-index tuning (4.25), Queryable Encryption prefix, suffix and substring query configuration (4.65), Secrets Management (3.95), Self-Managed Security Config (3.80)

← the whole tree · 3D view· how to read this page