Secure MongoDB Atlas with cnspec

Scan your MongoDB Atlas organizations and projects to find security risks before they become incidents. cnspec evaluates encryption at rest, network access rules, database user authentication, auditing, backup compliance, multi-factor authentication requirements, and dozens of other MongoDB Atlas controls.

If you're new to cnspec, start with the Quickstart. For an overview of every SaaS service cnspec can scan, see the SaaS scanning overview.

Prerequisites

To scan MongoDB Atlas with cnspec, you must have:

• cnspec installed on your workstation
• A MongoDB Atlas organization or project
• API credentials with read access to the resources you want to scan

Authenticate

cnspec connects to MongoDB Atlas using one of two methods:

• Programmatic API key (public and private key). To create one, see Grant programmatic access to an organization in the MongoDB Atlas documentation. Pass the keys with --public-key and --private-key.
• Service account (OAuth client ID and secret). Pass the credentials with --client-id and --client-secret.

You can scan at two levels:

• Organization discovers and scans every project in the organization. Pass --org-id (if you omit it, cnspec uses the first organization the credentials can access).
• Project scans a single project. Pass --project-id.

You can pass credentials on the command line or export them as environment variables:

# Programmatic API key
export MONGODB_ATLAS_PUBLIC_KEY=YOUR_PUBLIC_KEY
export MONGODB_ATLAS_PRIVATE_KEY=YOUR_PRIVATE_KEY

# Service account
export MONGODB_ATLAS_CLIENT_ID=YOUR_CLIENT_ID
export MONGODB_ATLAS_CLIENT_SECRET=YOUR_CLIENT_SECRET

# Optional scoping
export MONGODB_ATLAS_ORG_ID=YOUR_ORG_ID
export MONGODB_ATLAS_PROJECT_ID=YOUR_PROJECT_ID

Connection options

Verify with a quick MongoDB Atlas check

Confirm that cnspec can reach MongoDB Atlas by opening a cnspec shell:

cnspec shell mongodbatlas --org-id YOUR_ORG_ID --public-key YOUR_PUBLIC_KEY --private-key YOUR_PRIVATE_KEY

cnspec> mongodbatlas.organizationName
mongodbatlas.organizationName: "Acme Inc"

If cnspec connects and shows your organization, you're ready to scan.

Scan MongoDB Atlas

Scan an organization (this also discovers and scans every project):

cnspec scan mongodbatlas --org-id YOUR_ORG_ID --public-key YOUR_PUBLIC_KEY --private-key YOUR_PRIVATE_KEY

Scan a single project:

cnspec scan mongodbatlas --project-id YOUR_PROJECT_ID --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

When a scan completes, cnspec prints a summary of all the checks it ran, grouped by policy, along with a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To learn more about reading scan results, read Understand cnspec Results.

Scan with the Mondoo MongoDB Atlas Security policy

Mondoo maintains an out-of-the-box MongoDB Atlas Security policy that checks encryption at rest, network access rules, database user authentication, auditing, multi-factor authentication requirements, and more.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "MongoDB", and add the policy. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the policy bundle URL directly to cnspec:

cnspec scan mongodbatlas --org-id YOUR_ORG_ID --public-key YOUR_PUBLIC_KEY --private-key YOUR_PRIVATE_KEY \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-mongodbatlas-security.mql.yaml

You can also create your own policies to meet your specific requirements.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks.

List all projects

cnspec> mongodbatlas.projects { name id }

List all clusters

cnspec> mongodbatlas.clusters { name mongoDBMajorVersion encryptionAtRestProvider }

List database users

cnspec> mongodbatlas.databaseUsers { username databaseName }

List network access entries

cnspec> mongodbatlas.ipAccessList { cidrBlock comment }

Example security checks

Ensure the organization requires multi-factor authentication

cnspec> mongodbatlas.multiFactorAuthRequired == true
[ok] value: true

Ensure the organization requires an API access list

cnspec> mongodbatlas.apiAccessListRequired == true
[ok] value: true

Ensure all clusters encrypt data at rest with a customer key

An encryptionAtRestProvider of NONE means no customer-managed encryption:

cnspec> mongodbatlas.clusters.all(encryptionAtRestProvider != "NONE")
[ok] value: true

Ensure clusters enforce TLS 1.2 or higher

cnspec> mongodbatlas.clusters.all(minimumEnabledTlsProtocol == "TLS1_2")
[ok] value: true

Ensure no network access entry allows all IP addresses

cnspec> mongodbatlas.ipAccessList.none(cidrBlock == "0.0.0.0/0")
[ok] value: true

Ensure database auditing is enabled

cnspec> mongodbatlas.auditing.enabled == true
[ok] value: true

Ensure all clusters have backups enabled

cnspec> mongodbatlas.clusters.all(backupEnabled == true)
[ok] value: true

Ensure all clusters have termination protection enabled

cnspec> mongodbatlas.clusters.all(terminationProtectionEnabled == true)
[ok] value: true

Learn more

• MongoDB Atlas Resource Pack Reference: every MongoDB Atlas resource and field cnspec can query
• Write Effective MQL: guide to authoring checks and queries