Organization requires API access from allowlisted IPs

Check ID: organizations_api_access_list_required
Provider: MongoDB Atlas
Service: organizations
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: NotDefined

What this check verifies

MongoDB Atlas organizations can require Atlas Administration API requests to originate only from IPs or CIDRs listed in the organization’s API access list (apiAccessListRequired).

Risk

Without IP allowlisting, the Atlas Administration API is reachable from any network. A leaked token can be used from arbitrary hosts to:

change org/project settings and users
create, modify, or delete clusters This undermines integrity and availability and expands the blast radius of credential compromise.

Recommendation

Require the org API access list and restrict it to trusted, fixed egress IPs/CIDRs. Enforce least privilege on service accounts, prefer short-lived tokens, rotate secrets, and review entries regularly. Pair with MFA/SSO and monitoring for defense in depth.

Remediation

CLI
Terraform
Dashboard steps

curl --digest -u "<PUBLIC_KEY>:<PRIVATE_KEY>" -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v2/orgs/<ORG_ID>/settings" -d '{"apiAccessListRequired":true}'

resource "mongodbatlas_organization_settings" "<example_resource_name>" {
  org_id = "<example_resource_id>"

  api_access_list_required = true # Critical: Enforces that Atlas Admin API calls must originate from IPs on the org's API access list
}

References

Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_api_access_list_required. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to MongoDB Atlas checks

Cluster has TLS authentication enabled Organization requires MFA for user access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires