Cluster has authentication enabled

Check ID: clusters_authentication_enabled
Provider: MongoDB Atlas
Service: clusters
Severity: CRITICAL
Categories: identity-access
Resource type: NotDefined

What this check verifies

MongoDB Atlas clusters enforce database authentication for client connections (authEnabled). Identifies clusters where authentication is not required for access.

Risk

Without authentication, anyone with network reach can access the database, compromising confidentiality and integrity. Attackers can exfiltrate data, modify or delete records, and create backdoor users, leading to outages and data loss that impact availability.

Recommendation

Enable and enforce database authentication on all clusters.

Prefer strong methods (X.509, OIDC, AWS IAM) over static passwords
Grant least privilege roles and avoid shared accounts
Rotate credentials/keys
Combine with IP access lists or private endpoints for defense in depth

Remediation

CLI
Terraform
Dashboard steps

atlas dbusers create —username <USERNAME> —password <PASSWORD> —role readWriteAnyDatabase@admin —projectId <PROJECT_ID>

# Create a MongoDB Atlas database user to enable authentication
resource "mongodbatlas_database_user" "example_resource_name" {
  project_id         = "<example_resource_id>"
  username           = "<example_resource_name>"
  password           = "<PASSWORD>"
  auth_database_name = "admin"  # Critical: SCRAM user on admin enables DB auth

  roles {                         # Minimal role assignment required to create the user
    role_name     = "readWriteAnyDatabase"
    database_name = "admin"
  }
}

References

Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = clusters_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to MongoDB Atlas checks

MongoDB Atlas checks Cluster has backup enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires