Description

Ensure the Require IP Access List for the Atlas Administration API setting is turned on for the Atlas organization. With this setting on, every Atlas Administration API call made with a programmatic API key or a service account must come from an IP address or CIDR range on that key's or service account's access list.

Rationale

API keys and service account secrets give programmatic control over clusters, users, and network settings. If they leak, an attacker could use them from anywhere on the internet. Requiring an IP access list makes a stolen key useless unless it is used from an approved network, such as your CI/CD runners or office.

Impact

  • Leaked API keys cannot be used from unknown networks

  • Every API key and service account needs an access list entry

  • Automation from a new IP fails until that IP is added

Default Value

By default, this setting may be off for existing organizations, so API keys can be used from any IP address.

Pre-Requisites

  • Organization Owner role

  • The IP addresses of all tools and pipelines that call the Atlas Administration API

Test Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization from the ORGANIZATION menu near the top of the page, then in the sidebar click Organization Settings. The Organization Settings page displays.

  3. Verify that Require IP Access List for the Atlas Administration API is On.

  4. Alternatively, use the Atlas Administration API or the Atlas CLI (https://www.mongodb.com/docs/atlas/cli/current/). Run GET /api/atlas/v2/orgs/{orgId}/settings and check that apiAccessListRequired is true.

  5. If the setting is off, follow the implementation steps.

Implementation Steps

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Before turning the setting on, add the required IP addresses to the access list of every API key and service account (in the sidebar, under IDENTITY & ACCESS, click Applications, select the key or service account, and click Add Access List Entry).

  3. Select your organization from the ORGANIZATION menu near the top of the page, then in the sidebar click Organization Settings. The Organization Settings page displays.

  4. Toggle Require IP Access List for the Atlas Administration API to On.

  5. Confirm that your automation still works.

Backout Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization from the ORGANIZATION menu near the top of the page, then in the sidebar click Organization Settings. The Organization Settings page displays.

  3. Toggle Require IP Access List for the Atlas Administration API to Off.

Reference