Check ID:
Provider: MongoDB Atlas
Service:
Severity: MEDIUM
Categories:
Resource type:
projects_auditing_enabledProvider: MongoDB Atlas
Service:
projectsSeverity: MEDIUM
Categories:
logging, forensics-readyResource type:
NotDefinedWhat this check verifies
MongoDB Atlas projects with database auditing capture database operations and administrative events. The evaluation looks for an active audit configuration and, when present, notes any configuredaudit_filter that scopes which events are recorded.
Risk
Without auditing, critical actions lack traceability, reducing detectability and impeding forensics. Attackers can mask unauthorized reads/writes and privilege changes, threatening data confidentiality and integrity, and weakening non-repudiation and incident response.Recommendation
Enable auditing and apply least-privilege filters to capture high-risk events:- authentication and session activity
- DDL/config changes
- user/role modifications and privilege grants
auditAuthorizationSuccess to balance coverage vs performance.
Remediation
- CLI
- Terraform
- Dashboard steps
atlas auditing update —projectId <example_resource_id> —enabled
References
- https://www.mongodb.com/docs/manual/tutorial/configure-auditing/
- https://www.mongodb.com/docs/atlas/architecture/current/auditing/
- https://www.mongodb.com/docs/atlas/architecture/current/auditing-logging/?msockid=0878cc3dfa4e66a707beda0efb5a67b5
- https://www.mongodb.com/docs/atlas/operator/current/ak8so-configure-audit-logs/
- https://www.mongodb.com/docs/manual/core/auditing/
- https://www.mongodb.com/docs/atlas/database-auditing/
Where this check fires
This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable byCheck ID = projects_auditing_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to MongoDB Atlas checks