Skip to content

Update index.mdx #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 18, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 21 additions & 23 deletions docs/atlas/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,12 @@ import TabItem from '@theme/TabItem';

This guide covers essential security configurations for MongoDB deployments. Learn how to secure your databases using best practices for both Atlas and On-premises installations.

## Network Security
## Network security

<Tabs>
<TabItem value="atlas" label="MongoDB Atlas">

### IP Access List
### IP access list

Control which IP addresses can connect to your cluster:

Expand All @@ -25,7 +25,7 @@ atlas accessLists create --ip "203.0.113.0/24"
```
**Importance:** Restricting access to known IP addresses prevents unauthorized connections and reduces the risk of external attacks.

### Private Endpoints
### Private endpoints

Set up AWS PrivateLink:
```javascript
Expand All @@ -34,7 +34,7 @@ atlas privateEndpoints aws create --region us-east-1 --projectId 5e2211c17a3e5a4
```
**Importance:** Private endpoints ensure that traffic between your application and MongoDB Atlas remains within your private network, enhancing security and reducing exposure to the public internet.

### Network Peering
### Network peering

```javascript
// Set up VPC peering
Expand All @@ -45,7 +45,7 @@ atlas networking peering create aws --accountId 854333054055 --atlasCidrBlock 19
</TabItem>
<TabItem value="onprem" label="On-Premises">

### Firewall Configuration
### Firewall configuration

Configure iptables rules:
```bash
Expand All @@ -56,7 +56,7 @@ iptables -A INPUT -p tcp --dport 27017 -j ACCEPT
iptables -A INPUT -s 203.0.113.0/24 -p tcp --dport 27017 -j ACCEPT
```

### Network Binding
### Network binding

Configure mongod.conf:
```yaml
Expand All @@ -65,7 +65,7 @@ net:
port: 27017
```

### VPN Access
### VPN access

Set up OpenVPN server:
```bash
Expand All @@ -79,24 +79,24 @@ apt-get install openvpn
</TabItem>
</Tabs>

## Encryption Configuration
## Encryption configuration

<Tabs>
<TabItem value="atlas" label="MongoDB Atlas">

### Encryption at Rest
### Encryption at rest

Atlas automatically encrypts all data using:
- AWS: AWS KMS
- Azure: Azure Key Vault
- GCP: Cloud KMS
- AWS: AWS KMS.
- Azure: Azure Key Vault.
- GCP: Cloud KMS.

**Importance:** Encryption at rest protects your data from unauthorized access if the storage media is compromised.

</TabItem>
<TabItem value="onprem" label="On-Premises">

### Encryption at Rest
### Encryption at rest

Configure mongod.conf:
```yaml
Expand All @@ -112,7 +112,7 @@ chmod 600 /path/to/key.txt
```
**Importance:** Encryption at rest protects your data from unauthorized access if the storage media is compromised.

### Transport Encryption (TLS/SSL)
### Transport encryption (TLS/SSL)

```yaml
net:
Expand All @@ -126,37 +126,35 @@ net:
</TabItem>
</Tabs>



## Best Practices
## Best practices

<Tabs>
<TabItem value="atlas" label="MongoDB Atlas">

1. **Network Security**
1. **Network security**
- Use private endpoints where possible
- Regularly review IP access lists
- Implement VPC peering

2. **Access Management**
2. **Access management**
- Follow principle of least privilege
- Regular credential rotation
- Use strong authentication methods

3. **Monitoring and Alerts**
3. **Monitoring and alerts**
- Set up alerts for security events
- Monitor access patterns
- Review audit logs regularly

</TabItem>
<TabItem value="onprem" label="On-Premises">

1. **System Security**
1. **System security**
- Regular system updates
- Security patch management
- Resource limits configuration

2. **Network Security**
2. **Network security**
- Configure firewalls
- Set up VPN access
- Implement network segmentation
Expand All @@ -169,7 +167,7 @@ net:
</TabItem>
</Tabs>

## Next Steps
## Next steps

Let's start the [network access control challenge](./challenge/network).