Description

Ensure every Atlas cluster requires clients to authenticate, using database users with SCRAM passwords, X.509 certificates, LDAP, AWS IAM, or OIDC. Atlas enforces authentication on all clusters, so this check also confirms that database users are configured correctly and use strong authentication.

Rationale

Without authentication, anyone who can reach the cluster could read or change all of its data. Atlas always requires authentication, but weak setups, such as shared users or users with broad roles, still put data at risk. Using named database users with least-privilege roles and strong authentication methods keeps access controlled.

Impact

  • Only authenticated users can connect to the cluster

  • Each application or person has its own database user

  • Applications must provide valid credentials

Default Value

Atlas enforces authentication on all clusters, and it cannot be turned off.

Pre-Requisites

  • Project Owner role, or Project Database Access Admin

Test Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. Open the Database Users tab and review each user, its authentication method, and its roles.

  5. Confirm that there are no shared or unused users, and that users have only the roles they need.

  6. If the check reports authentication disabled, or users are shared or too broad, follow the implementation steps.

Implementation Steps

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. On the Database Users tab, click Add New Database User for each application or person, choose the authentication method (Password with SCRAM, Certificate, AWS IAM, LDAP, or OIDC), and grant only the needed roles.

  5. Click Add User.

  6. Update applications to use their own users, then delete shared or unused users from the Database Users tab.

Backout Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. Re-create a deleted database user on the Database Users tab if an application still needs it.

Reference