Check ID: clusters_tls_enabled
Provider: MongoDB Atlas
Service: clusters
Severity: HIGH
Categories: encryption
Resource type: NotDefined

​
What this check verifies

MongoDB Atlas clusters require TLS/SSL for client connections to encrypt data in transit (sslEnabled=true).

​
Risk

Without enforced TLS, traffic can be intercepted or altered, degrading confidentiality and integrity. Attackers can run man-in-the-middle attacks, steal credentials or session tokens, and inject/replay queries, leading to unauthorized data access.

​
Recommendation

Enforce TLS 1.2+ for all connections and keep it mandatory (sslEnabled=true). Apply zero trust and defense in depth: use CA-signed certificates, disable tlsInsecure and similar bypasses, rotate certificates, and restrict access via private networking or trusted IP ranges.

​
Remediation

curl -u "<PUBLIC_KEY>:<PRIVATE_KEY>" --digest -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v1.5/groups/<PROJECT_ID>/clusters/<CLUSTER_NAME>" --data '{"sslEnabled": true}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = clusters_tls_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to MongoDB Atlas checks