UXDL Docs
Infrastructure

VPC Peering

Private connectivity between MongoDB Atlas and an AWS VPC — no public internet.

MongoDB Atlas supports VPC Peering, enabling private network connectivity between an AWS Virtual Private Cloud (VPC) and a MongoDB Atlas project. Application traffic stays on the AWS private network and never traverses the public internet, providing improved security, lower latency, and simplified access.

Objectives

  • Establish secure private communication between AWS workloads and MongoDB Atlas.
  • Eliminate exposure of database traffic to the public internet.
  • Reduce network latency.
  • Improve security by restricting database access to private networks.
  • Simplify firewall and network access management.
  • Support production-grade, highly secure deployments.

Architecture

Components

ComponentDescription
MongoDB AtlasHosts the managed cluster within its own VPC (replica sets, private IPs).
AWS VPCHosts application workloads — ECS, EC2, EKS, or Lambda (within the VPC).
VPC Peering ConnectionPrivate routing between the AWS VPC and the Atlas VPC.

A VPC Peering Connection provides private IP communication with no internet gateway, VPN, or NAT Gateway required — traffic stays on the AWS backbone network.

Connectivity flow

  1. An application in the AWS VPC initiates a connection to the MongoDB Atlas cluster.
  2. DNS resolves the Atlas private endpoint to a private IP address.
  3. The request is routed through the VPC Peering Connection.
  4. MongoDB Atlas receives the request over its private VPC.
  5. The database responds through the same private path.

All communication remains within private AWS networking.

Configuration steps

  1. Create an AWS VPC with a non-overlapping CIDR block, private subnets for workloads, and appropriate route tables.
  2. Create a peering request from the Atlas console (Network Access → Peering): select AWS and enter the AWS Account ID, Region, VPC ID, and VPC CIDR.
  3. Accept the request in the AWS Console under VPC → Peering Connections.
  4. Update route tables in the AWS VPC to direct traffic for the Atlas CIDR through the peering connection. Atlas configures its side automatically.
  5. Configure security — allow outbound traffic to MongoDB ports (typically TCP 27017) and permit the AWS VPC CIDR in Atlas network access.
  6. Verify connectivity by resolving the Atlas hostname, connecting with the connection string, and running a test query.

Security considerations

  • Use private IP communication only.
  • Enable TLS encryption for all MongoDB client connections.
  • Apply least-privilege security group rules.
  • Restrict Atlas network access to trusted VPC CIDR ranges.
  • Use strong authentication and role-based access control (RBAC).
  • Store database credentials securely (for example, AWS Secrets Manager).