Check ID: projects_network_access_list_exposed_to_internet
Provider: MongoDB Atlas
Service: projects
Severity: HIGH
Categories: internet-exposed
Resource type: NotDefined

​
What this check verifies

MongoDB Atlas project network access list configuration is evaluated for entries that allow access from anywhere (0.0.0.0/0, ::/0, 0.0.0.0, ::) or for missing access lists, instead of restricting connections to specific IPs or CIDRs.

​
Risk

Internet-wide access enables scanning, brute force, and credential stuffing against database endpoints. A successful compromise can cause data exfiltration (confidentiality), unauthorized writes or drops (integrity), and service disruption or lockout (availability).

​
Recommendation

Apply least privilege: permit only required IPs/CIDRs or approved security groups; avoid 0.0.0.0/0 and ::/0. Prefer private connectivity (VPC peering or private endpoints) over public access. Use temporary entries for short-lived admin needs and review lists regularly.

​
Remediation

resource "mongodbatlas_project_ip_access_list" "<example_resource_name>" {
  project_id = "<example_resource_id>"
  cidr_block = "<ALLOWED_CIDR>" # Critical: add a restricted CIDR (not 0.0.0.0/0 or ::/0) to ensure the list isn't empty and not open to the world
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = projects_network_access_list_exposed_to_internet. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to MongoDB Atlas checks