Description

Ensure each Atlas project's IP access list contains only specific, trusted IP addresses or CIDR ranges, such as application servers, VPNs, or office networks, and does not contain entries that allow every address, such as 0.0.0.0/0, ::/0, 0.0.0.0, or ::.

Rationale

The IP access list is the network firewall in front of your clusters. An entry like 0.0.0.0/0 (Allow Access from Anywhere) lets anyone on the internet attempt to connect and guess passwords. Limiting the list to known addresses means attackers are blocked before authentication even happens.

Impact

  • Only approved networks can reach the clusters

  • Blocks connection attempts from the internet

  • New application servers must be added to the list

Default Value

By default, a new project's IP access list is empty, so no client can connect until entries are added. Allow Access from Anywhere adds 0.0.0.0/0 if selected.

Pre-Requisites

  • Project Owner role

  • A list of IP addresses or ranges that need access

Test Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. Open the IP Access List tab and review every entry.

  5. Alternatively, run: atlas accessLists list

  6. If the list is empty, or contains 0.0.0.0/0, ::/0, 0.0.0.0, or ::, follow the implementation steps.

Implementation Steps

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. On the IP Access List tab, click Add IP Address, enter each trusted IP address or CIDR range with a comment, and click Confirm.

  5. Click Delete for each entry that allows all addresses (0.0.0.0/0, ::/0, 0.0.0.0, or ::), and confirm.

  6. Alternatively, run: atlas accessLists delete "0.0.0.0/0"

  7. Confirm that applications can still connect.

Backout Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. On the IP Access List tab, click Add IP Address and re-add the removed entry.

Reference