Description

Ensure Database Auditing is turned on for each Atlas project, so that Atlas records database events such as authentication attempts, user and role changes, and schema changes for all dedicated clusters in the project. A custom filter can be used to choose which events are recorded.

Rationale

Without auditing, there is no record of who logged in to the database or changed users, roles, or collections. This makes it very hard to detect misuse or investigate incidents. Auditing provides an activity trail that supports security monitoring and compliance requirements.

Impact

  • Database activity is recorded for investigations

  • Supports compliance requirements

  • Auditing can affect performance and adds log volume

Default Value

By default, database auditing is turned off. It is available for M10 and higher clusters.

Pre-Requisites

  • Project Owner role

  • M10 or higher clusters

Test Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. In the sidebar, click Advanced. The Advanced page displays.

  5. Verify that Database Auditing is On.

  6. Alternatively, run: atlas auditing describe

  7. If auditing is off, follow the implementation steps.

Implementation Steps

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. In the sidebar, click Advanced. The Advanced page displays.

  5. Under Database Auditing, toggle the setting to On.

  6. Under Configure Your Auditing Filter, select the users, roles, and actions to audit, or click Use Custom JSON Filter to define your own filter.

  7. Click Save.

  8. Alternatively, run: atlas auditing update --enabled

Backout Plan

  1. Log in to MongoDB Atlas at https://cloud.mongodb.com.

  2. Select your organization and project from the menus at the top of the page.

  3. In the sidebar, under the SECURITY heading, click Database & Network Access.

  4. In the sidebar, click Advanced. The Advanced page displays.

  5. Toggle Database Auditing to Off and save.

Reference