> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Atlas Resource Policies Overview As of May 2026, you can now use Atlas Resource Policies to: - Require that sharded clusters use only dedicated config servers instead of embedded config servers. - Require that Customer-Managed Key encryption at rest is enabled for all clusters. - Require that database auditing is enabled for a project. **Note:** This page applies to both Atlas Infinite and Atlas Core. Atlas Resource Policies are controls that enable [`Organization Owners`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) to constrain the specific configuration options available to developers when they create or configure Atlas clusters. **Note:** The MongoDB Atlas Shared Responsibility Model defines the complementary duties of MongoDB and its customers in maintaining a secure and resilient data environment. Under this framework, MongoDB manages the security and operational integrity of the underlying platform, while customers are responsible for the configuration, management, and data policies of their specific deployments. For a detailed breakdown of ownership across security and operational excellence, see [Shared Responsibility Model.](https://www.mongodb.com/resources/products/fundamentals/shared-responsibility) With resource policies, you can: - Limit the number of clusters that can be created in a project. - Limit cluster deployment to specific cloud platforms (AWS (Amazon Web Services), Google Cloud, Azure (Microsoft Azure)). - Restrict cluster deployment to designated regions within a cloud provider. For example, `aws:us-east-1`. - Prohibit the use of wildcard IPv4 CIDR ranges (any `/0` mask, such as `0.0.0.0/0` or `10.0.0.0/0`) to enforce stricter network controls. - Prohibit traffic through public networks by requiring that the IP access list remain empty or by preventing additions to an existing IP access list. **Note:** If you add to a project access list any IPv4 `/0` CIDR, such as `0.0.0.0/0` or `10.0.0.0/0`, Atlas sends an alert email to all users directly granted a role to the project, or indirectly granted a role through team membership (if the team is granted a role to the project). - Require that a project has a [maintenance window](https://www.mongodb.com/docs/atlas/tutorial/cluster-maintenance-window.md#std-label-configure-maintenance-window) configured. - Prevent modifications to VPC (Virtual Private Cloud) peering and private endpoint connections across cloud providers. - Impose a minimum TLS (Transport Layer Security) version or require a specific TLS (Transport Layer Security) cipher suite configuration for cluster connections. - Enforce minimum and maximum cluster tiers and [auto-scaling](https://www.mongodb.com/docs/atlas/cluster-autoscaling.md#std-label-cluster-autoscaling) sizes across your organization. If enabled, this policy prevents users from provisioning, updating, or [auto-scaling](https://www.mongodb.com/docs/atlas/cluster-autoscaling.md#std-label-cluster-autoscaling) clusters to a tier above or below a specified threshold. - Require that sharded clusters use only [dedicated config servers](https://www.mongodb.com/docs/atlas/cluster-additional-settings.md#std-label-nodes-for-config-server) instead of embedded config servers. - Enforce minimum and maximum disk size for all clusters. - Enforce the use of a specific cluster topology *only* ([replica set](https://www.mongodb.com/docs/manual/replication.md#std-label-replication), [sharded cluster](https://www.mongodb.com/docs/manual/sharding.md#std-label-sharding-background), or [global cluster](https://www.mongodb.com/docs/atlas/global-clusters.md#std-label-global-clusters)). - Enforce a minimum and maximum number of shards for sharded clusters. - Require database auditing on all clusters in a project. - Require Customer-Managed Keys for encryption at rest on all clusters in a project. - Require Customer-Managed Keys for encryption at rest on all dedicated search deployments in a project. - Prevent projects from enabling Native Reranking (the `$rerank` aggregation stage). **Important:** By default, Atlas Resource Policies are organization-wide. These policies automatically enforce standards across all projects and clusters within the organization. However, Atlas provides flexibility. You can exclude specific projects from an Atlas Resource Policy. This functionality allows most projects to inherit consistent organization-wide standards while enabling exceptions for cases with unique requirements. In addition to the Atlas UI and the [Atlas Administration API](https://www.mongodb.com/docs/atlas/api/atlas-admin-api.md#std-label-atlas-admin-api), you can use the [HashiCorp Terraform MongoDB Atlas Provider](https://www.mongodb.com/docs/atlas/api.md#std-label-atlas-programmatic-access-terraform-overview), [MongoDB Atlas AWS CloudFormation Resources](https://www.mongodb.com/docs/atlas/api.md#std-label-atlas-programmatic-access-cloudformation-overview), or [AWS CloudFormation](https://constructs.dev/packages/awscdk-resources-mongodbatlas/v/3.9.0/api/CfnResourcePolicy?lang=typescript) to configure and manage Atlas Resource Policies. **Note:** For [HashiCorp Terraform MongoDB Atlas Provider](https://www.mongodb.com/docs/atlas/api.md#std-label-atlas-programmatic-access-terraform-overview), use 1.33.0 or later to impose a minimum TLS (Transport Layer Security) version or require a specific TLS (Transport Layer Security) cipher suite configuration for cluster connections. Atlas might block connections from earlier versions of Terraform. ## Prerequisites - Ensure your Atlas user has the appropriate organization role: - To view Atlas Resource Policies, you must have at least [`Organization Read Only`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Read-Only) or [`Organization Member`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Member) access to Atlas. - To create, update, or delete an Atlas Resource Policy, you must have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) access to Atlas. - To use the Atlas Administration API to create or manage Atlas Resource Policies, locate your public and private API (Application Programming Interface) keys so you can authenticate to the [Atlas Administration API](https://www.mongodb.com/docs/atlas/api/atlas-admin-api.md#std-label-atlas-admin-api). To learn more, see [Get Started with the Atlas Administration API.](https://www.mongodb.com/docs/atlas/configure-api-access.md#std-label-atlas-admin-api-access) ## Limitations - *We strongly recommend that you proactively monitor your list of non-compliant resources* using the [/orgs/\{ORG-ID}/nonCompliantResources](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) endpoint. Atlas Resource Policies ensure compliance with defined goals but do not enforce intermediate or transitional states. For example, if a downstream component fails, the policy may temporarily enter a non-compliant intermediate state. - Each Atlas Resource Policy must have a unique name. If you attempt to create an Atlas Resource Policy with an existing name, the server returns a `400 (Bad Request)` status code. - It's possible to create identical Atlas Resource Policies with different names. While this doesn't cause functional conflicts, it can lead to redundancy and confusion in policy management. - Atlas Resource Policies are allow-by-default. If no Atlas Resource Policies exist, users can perform all actions on Atlas clusters that their [Atlas user role](https://www.mongodb.com/docs/atlas/reference/user-roles.md#std-label-user-roles) allows. - Our implemented version of [Cedar policy language](https://docs.cedarpolicy.com/) supports only one Cedar policy per `.cedar` file, but you can list multiple Cedar policies (`.cedar` files) in your Atlas Resource Policy. Each `.cedar` file is identified in the [Atlas Administration API](https://www.mongodb.com/docs/atlas/api/atlas-admin-api.md#std-label-atlas-admin-api) response as a unique 24-hexadecimal character string after `policies.id`. - If the [auto-scaling](https://www.mongodb.com/docs/atlas/cluster-autoscaling.md#std-label-cluster-autoscaling) limits on your existing cluster don't match the new Atlas Resource Policy, the cluster might exceed the policy's defined boundaries. To address this issue, use the [/orgs/\{ORG-ID}/nonCompliantResources](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) endpoint to identify and monitor non-compliant resources so you can update them to meet policy requirements. - If existing [auto-scaling](https://www.mongodb.com/docs/atlas/cluster-autoscaling.md#std-label-cluster-autoscaling) limits exceed a new Atlas Resource Policy, the cluster can continue to scale automatically beyond policy boundaries. However, you cannot manually scale the cluster beyond the policy limits. Use the [/orgs/\{ORG-ID}/nonCompliantResources](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-/orgs/\{ORG-ID}/nonCompliantResources) endpoint to identify and monitor non-compliant resources. - Before enabling network-layer controls, review your existing [IP access list](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) to ensure it contains all necessary access points. - Private endpoint definitions in [Cedar policy language](https://docs.cedarpolicy.com/) require that you enter individual IP addresses, as wildcard operations are not supported. - When enforcing disk size, ensure you account for the specific requirements of your instance sizes and cloud provider limits. - If you [enforce a minimum shard count](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-shard-count) greater than one, you must explicitly allow the transition state for cluster conversions in your policy (for example, `&& !context.cluster.isConvertingToSharded`). Without this exception, Atlas blocks users from converting a replica set to a sharded cluster because the conversion process requires an intermediate state where the cluster has only one shard. - Atlas treats a replica set as having a shard count of one. If you enforce a minimum shard count greater than one without checking whether clusters are sharded clusters, all replica sets in the project are marked as non-compliant. ## Using the Cedar Policy Language MongoDB uses the open-source [Cedar policy language](https://docs.cedarpolicy.com/) to define Atlas Resource Policies. Cedar's design balances expressiveness with simplicity, employing a concise syntax that streamlines both writing and understanding resource policies. To quickly create an Atlas Resource Policy, adapt the [examples](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-arp-examples) and add to Atlas using the Atlas UI or Atlas Administration API by following [Create an Atlas Resource Policy Configuration.](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-procedure-create-atlas-resource-policy) To learn more about [Cedar policy language](https://docs.cedarpolicy.com/), see: - [Key Cedar Syntax Elements for Atlas](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-key-cedar-elements) - [Restrict Cloud Provider and Region](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-example-cedar-policy) - [Cedar GitHub Repository.](https://github.com/cedar-policy) ### Key Cedar Syntax Elements for Atlas | Cedar Element | Descripton | Atlas Resource Policy Options | | --- | --- | --- | | `forbid` | Denies the specified action if conditions in the `when` clause are met. The converse element, `permit`, is not allowed in Atlas Resource Policies. | Example: `forbid (principal, action, resource) when { ... };` | | `principal` | Defines the user affected by the policy. | Applied universally by default. Do not change or omit. | | `action` | Represents the action being controlled in the policy. | Available actions: Restrict IP access list: `ResourcePolicy::Action::"project.ipAccessList.modify"`; Restrict cluster attributes: `ResourcePolicy::Action::"cluster.modify"`; Modify maintenance window: `ResourcePolicy::Action::"project.maintenanceWindow.modify"`; Restrict search index modifications: `ResourcePolicy::Action::"search.index.modify"`; Restrict search deployment operations: `ResourcePolicy::Action::"search.deployment.modify"`; Restrict Native Reranking: `ResourcePolicy::Action::"project.rerank.modify"`; Restrict access to the Atlas Embedding and Reranking API: `ResourcePolicy::Action::"project.aiModelAPI.modify"` | | `ResourcePolicy::Cluster::""` | Refers to a specific cluster | To find your cluster ID, use the Atlas Administration API to [return all clusters in a project.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listgroupclusters) | | `ResourcePolicy::Project::""` | Refers to a specific project. For example, `ResourcePolicy::Project::"6217f7fff7957854e2d09179"` | To find your project ID, see [Manage Project Settings.](https://www.mongodb.com/docs/atlas/tutorial/manage-project-settings.md#std-label-atlas-modify-project-settings) | | `context.cluster.project` | Specifies the project to which the cluster belongs. | To find your project ID, see [Manage Project Settings.](https://www.mongodb.com/docs/atlas/tutorial/manage-project-settings.md#std-label-atlas-modify-project-settings) | | `context.cluster.cloudProviders` | Specifies the allowed cloud providers. | Available options: `ResourcePolicy::CloudProvider::"aws"`; `ResourcePolicy::CloudProvider::"azure"`; `ResourcePolicy::CloudProvider::"gcp"` The value differs by action. For `cluster.modify`, contains the cloud providers of the cluster's mongod nodes. For `search.index.modify`, contains the cloud providers of mongod and MongoDB Search nodes (current state). For `search.deployment.modify`, contains the cloud providers of MongoDB Search nodes after the request completes. For deletion operations, this value is empty. | | `context.cluster.clusterType` | Specifies the cluster topology: [replica set](https://www.mongodb.com/docs/manual/replication.md#std-label-replication), [sharded cluster](https://www.mongodb.com/docs/manual/sharding.md#std-label-sharding-background), or [global cluster.](https://www.mongodb.com/docs/atlas/global-clusters.md#std-label-global-clusters) | Available options: `ResourcePolicy::ClusterType::"replicaset"`; `ResourcePolicy::ClusterType::"sharded"`; `ResourcePolicy::ClusterType::"geosharded"` | | `context.cluster.diskSizeGB` | Specifies the disk size in GB. | For example, `context.cluster.diskSizeGB < 100` matches clusters with less than 100 GB of storage. | | `context.cluster.minShardCount` | The current actual number of shards. Use only to enforce *minimum* shard counts. WARNING: Do not use this property to enforce *maximums*. | For example, `context.cluster.minShardCount < 3` matches clusters that currently have fewer than three shards. | | `context.cluster.maxShardCount` | The maximum possible number of shards. Use only to enforce *maximum* shard limits. WARNING: Do not use this property to enforce *minimums*. | For example, `context.cluster.maxShardCount > 10` matches clusters that have more than ten shards. | | `context.cluster.isConvertingToSharded` | Checks if the current operation is converting a replica set to a sharded cluster. Required when enforcing minimum shard counts to allow the initial transition. | For example, `context.cluster.isConvertingToSharded == true` | | `context.cluster.regions` | Limits access based on deployment regions. | For example, `ResourcePolicy::Region::"aws:us-east-1"`. For a list of available regions by cloud provider see [Amazon Web Services (AWS)](https://www.mongodb.com/docs/atlas/reference/amazon-aws.md#std-label-amazon-aws), [Google Cloud](https://www.mongodb.com/docs/atlas/reference/google-gcp.md#std-label-google-gcp), or [Microsoft Azure](https://www.mongodb.com/docs/atlas/reference/microsoft-azure.md#std-label-microsoft-azure). When used with `search.deployment.modify`, contains the regions of MongoDB Search nodes after the request completes. For deletion operations, this value is empty. | | `context.cluster has ` | Checks if a specific property exists within the cluster context. | Available properties: Minimum General class [cluster tier](https://www.mongodb.com/docs/atlas/manage-clusters.md#std-label-create-cluster-instance): `minGeneralClassInstanceSizeValue`; Maximum General class [cluster tier](https://www.mongodb.com/docs/atlas/manage-clusters.md#std-label-create-cluster-instance): `maxGeneralClassInstanceSizeValue`; Disk size (GB): `diskSizeGB` | | `context.cluster.minGeneralClassInstanceSizeValue` | Sets the minimum [cluster tier](https://www.mongodb.com/docs/atlas/manage-clusters.md#std-label-create-cluster-instance) for scaling the cluster down to. | For example, `context.cluster.minGeneralClassInstanceSizeValue < 30` matches clusters whose current tier or minimum [auto-scaling](https://www.mongodb.com/docs/atlas/cluster-autoscaling.md#std-label-cluster-autoscaling) size is less than `M30`. | | `context.cluster.maxGeneralClassInstanceSizeValue` | Sets the maximum [cluster tier](https://www.mongodb.com/docs/atlas/manage-clusters.md#std-label-create-cluster-instance) for scaling the cluster up to. | For example, `context.cluster.maxGeneralClassInstanceSizeValue < 60` matches clusters whose current tier or maximum [auto-scaling](https://www.mongodb.com/docs/atlas/cluster-autoscaling.md#std-label-cluster-autoscaling) size is less than `M60`. | | `context.cluster.encryptionAtRest.customerManagedKey.enabled` | Checks if Customer-Managed Keys for encryption at rest are enabled for the cluster. Use with the `cluster.modify` action. | For example, `context.cluster.encryptionAtRest.customerManagedKey.enabled == false` checks if the cluster does not have CMK enabled. | | `context.project.clustersInProject` | Specifies the number of clusters currently in a project. | For example, `context.project.clustersInProject <= 3` matches projects with three or fewer clusters. | | `context.project.hasDefinedMaintenanceWindow` | Requires that a project has a [maintenance window](https://www.mongodb.com/docs/atlas/tutorial/cluster-maintenance-window.md#std-label-configure-maintenance-window) configured. | For example, `context.project.hasDefinedMaintenanceWindow == false` checks if the project has no maintenance window configured. | | `context.project.databaseAuditing.enabled` | Checks if database auditing is enabled for the project. Use with the `cluster.modify` action. | For example, `context.project.databaseAuditing.enabled == false` checks if the project has database auditing disabled. | | `context.project.rerankEnabled` | Checks if Native Reranking (the `$rerank` aggregation stage) is enabled for the project. Use with the `project.rerank.modify` action. | For example, `context.project.rerankEnabled == true` matches projects that have Native Reranking enabled. This prevents users from enabling Native Reranking while still allowing projects that already have it enabled to disable it. | | `context.project.ipAccessList` | Specifies the IP addresses that can access the cluster. | You can block a wildcard IP `ip("0.0.0.0/0")` to enhance security. | | `context.project.peeringConnections` | Refers to a specific VPC (Virtual Private Cloud) peering connection. | To format for your specific cloud provider, see [Prevent Modifications to Network Peering.](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-prevent-peering-modifications) | | `context.project.privateEndpoints` | Refers to a specific private endpoint. | To format for your specific cloud provider, see [Prevent Modifications to Private Endpoints.](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-prevent-private-endpoint-modifications) | | `containsAny` and `containsAll` | Checks for inclusion of one or more elements (`containsAny`) or all elements (`containsAll`) from a list. | Example: `context.cluster.regions.containsAny([ResourcePolicy::Region::"aws:us-east-1"])` | | `unless` | Specifies exceptions to a policy. Actions are forbidden unless certain conditions are met. | Example: `forbid (principal, action, resource) unless { condition };` | | `isEmpty` | Checks whether a list is empty. For example, enforcing no access over public networks requires that the IP access list is empty. | `forbid (principal, action == ResourcePolicy::Action::"project.ipAccessList.modify", resource) unless { context.project.ipAccessList.isEmpty() };` | | Logical Operators (`&&`, `||`, `!`) | Combine multiple conditions in a policy. | Available options: `&&` (AND): Requires all conditions to be true.; `||` (OR): Requires at least one condition to be true.; `!` (NOT): Requires a condition to be false. | | `context.cluster.configServerManagementMode` | Checks for config server management mode on sharded clusters. | Available options: `ResourcePolicy::ConfigServerManagementMode::"fixed_to_dedicated"` for dedicated config servers.; `ResourcePolicy::ConfigServerManagementMode::"atlas_managed"` for embedded config servers. | | `context.search.hasDedicatedNodes` | Checks if the cluster has dedicated MongoDB Search nodes. For `search.deployment.modify`, this attribute reflects the state after the request completes, not the current state. | For example, `context.search.hasDedicatedNodes == true`. Use with the `search.index.modify` and `search.deployment.modify` actions. | | `context.search.hasIndexes` | Checks if the cluster has MongoDB Search indexes. | For example, `context.search.hasIndexes == true`. Use with the `search.deployment.modify` and `cluster.modify` actions. | | `context.search.encryptionAtRest.customerManagedKey.enabled` | Checks if Customer-Managed Keys for encryption at rest are effectively enabled for dedicated search deployments. This evaluates to `true` only when both search-node CMK is enabled AND at least one KMS provider is configured at the project level. Use with the `search.deployment.modify` action. | For example, `context.search.encryptionAtRest.customerManagedKey.enabled == false` checks if the search deployment does not have CMK effectively enabled. | | IP Addressing (`ip`) | Refers to specific IP addresses or ranges in policies. | Available options: Specific IP addresses, formatted as `ip("1.2.3.4/32")`.; `ip("0.0.0.0/0")` for wildcard IP. Any IPV4 `/0` CIDR represents the full IPv4 address space. Atlas normalizes such CIDRs to 0.0.0.0/0 to evaluate policies. | | `context.search.index.isAutoEmbed` | Checks if a search index uses Automated Embedding. If `true`, the search index automatically generates vector embeddings using a Voyage AI embedding model. | Example: `context.search.index.isAutoEmbed == true` This matches indexes that use Automated Embedding and allows you to restrict creation or modification of Automated Embedding indexes for compliance or cost governance. You can still create `vector` type indexes. | | `context.aiModelApi.geography` | Specifies the [Geography](https://www.mongodb.com/docs/atlas/geographies.md#std-label-atlas-geographies) that a [model API key](https://www.mongodb.com/docs/voyageai/management/api-keys.md#std-label-voyage-api-keys) is scoped to. Use with the `project.aiModelAPI.modify` action. | Available options: `ResourcePolicy::Geography::"eu"` for Europe.; `ResourcePolicy::Geography::"us"` for the United States. | ## Create an Atlas Resource Policy Configuration To create an Atlas Resource Policy, use the following procedure to construct a policy by using [Cedar policy language](https://docs.cedarpolicy.com/) and add to Atlas by using the Atlas UI, the Atlas Administration API, or Terraform. **Warning:** We recommend that you test this feature in a non-production environment by creating a new organization with a fresh cluster. This ensures you can assess the feature safely without impacting your existing systems as you skill up. ### Atlas Administration API To create an Atlas Resource Policy using the Atlas Administration API, construct a policy using [Cedar policy language](https://docs.cedarpolicy.com/) and pass it in to the Atlas Administration API via a `POST` request using the `policies` parameter. 1. Construct the policy in the Cedar policy language. Specify the rules for restricting resources using [Cedar policy language](https://docs.cedarpolicy.com/). You can copy and modify the following example policies for your organization: - [Restrict Number of Clusters](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-number-of-clusters-api) - [Restrict Cloud Provider](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-cloud-provider) - [Restrict Cloud Provider Region](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-region) - [Restrict Cloud Provider and Region](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-example-cedar-policy) - [Restrict IP Addresses](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-ip-addresses) - [Restrict Cluster Tier Sizes](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-cluster-tier) - [Require Project Maintenance Windows](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-require-maintenance-window) - [Require Database Auditing](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-require-database-auditing) - [Require Customer-Managed Keys on All Clusters](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-require-cmk-clusters) - [Require Customer-Managed Keys on All Dedicated Search Deployments](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-require-cmk-search) - [Enforce Customer-Managed Keys on All Organization Data (AWS Only)](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-require-cmk-all-org-data) - [Prevent Modifications to Network Peering](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-prevent-peering-modifications) - [Prevent Modifications to Private Endpoints](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-prevent-private-endpoint-modifications) - [Restrict TLS (Transport Layer Security) Protocol and Cipher Suites](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-tls-api) - [Enforce Disk Size (GB)](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-enforce-disk-size) - [Enforce Cluster Topology (Replica Set, Sharded, or Global Cluster)](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-cluster-type) - [Enforce Minimum Shard Count](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-shard-count) - [Enforce Dedicated Config Servers for Sharded Clusters](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-enforce-config-server-management-mode) - [Restrict MongoDB Search Index Operations](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-search-index-modify) - [Restrict Automated Embedding for MongoDB Vector Search](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-auto-embedding) - [Restrict MongoDB Search Deployment Operations](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-search-deployment-modify) - [Restrict Native Reranking](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-restrict-native-reranking) **Note:** We recommend creating multiple, simple Atlas Resource Policies to make tracking easier. For example, if you want to restrict cloud provider and multiple regions, consider creating one Atlas Resource Policy that restricts the cloud provider and another Atlas Resource Policy that restricts the regions. 2. Send a `POST` request. Use the `POST` verb to create an Atlas Resource Policy for your organization. The request must include: - `name`: The name of the Atlas Resource Policy. - `policies`: The cluster restrictions you defined in [Cedar policy language](https://docs.cedarpolicy.com/) in the previous step. If you use quotes (`"`) in `policies.body`, escape with a backslash (`\`). Example `POST` request: **Note:** This `curl` command uses a service account access token ([OAuth 2.0](https://oauth.net/2/)) to authenticate instead of API keys. To learn more, see [Get Started with the Atlas Administration API.](https://www.mongodb.com/docs/atlas/configure-api-access.md#std-label-atlas-admin-api-access) ```sh curl --header "Authorization: Bearer {ACCESS-TOKEN}" \ --header "Content-Type: application/json" \ --header "Accept: application/vnd.atlas.2024-08-05+json" \ --include \ --request POST "https://cloud.mongodb.com/api/atlas/v2/orgs/{ORG-ID}/resourcePolicies?pretty=true" \ --data '{ "name": "MyResourcePolicy", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when {context.cluster.regions.contains(ResourcePolicy::Region::\"aws:us-west-1\")};" } ] }' ``` Example response: ```json { "createdByUser" : { "id" : "66ce81217d08f463824f3b80", "name" : "ecwwjhop" }, "createdDate" : "2024-08-28T02:22:49Z", "id" : "66ce89f9b535d00a2cb02f83", "lastUpdatedByUser" : { "id" : "66ce81217d08f463824f3b80", "name" : "ecwwjhop" }, "lastUpdatedDate" : "2024-08-28T02:22:49Z", "name" : "MyResourcePolicy", "orgId" : "{ORG-ID}", "policies" : [ { "body" : "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when {context.cluster.regions.contains(ResourcePolicy::Region::\"aws:us-west-1\")};", "id" : "66ce89f9b535d00a2cb02f82" } ], "version" : "v1" ``` ## Atlas Resource Policy Examples Copy and modify the following example policies to use for your organization. All examples use [Cedar policy language](https://docs.cedarpolicy.com/), but for the Atlas Administration API, the examples are wrapped in JSON (Javascript Object Notation) so you can paste them directly into your API (Application Programming Interface) calls. To learn more, see [Create an Atlas Resource Policy Configuration.](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md#std-label-procedure-create-atlas-resource-policy) ### Atlas Administration API ### Restrict Number of Clusters The following example prevents users from creating more than `2` clusters in a project: ```text { "name": "Prohibit More Than 2 Clusters in a Project", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.project.clustersInProject > 2 };" } ] } ``` ### Restrict Cloud Provider The following example prevents users from creating a cluster on Google Cloud: ```text { "name": "Policy Preventing GCP Clusters", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.cloudProviders.contains(ResourcePolicy::CloudProvider::\"gcp\") };" } ] } ``` The following example uses the `unless` clause to allow users to create clusters *only* on Google Cloud: ```text { "name": "Policy Allowing Only GCP Clusters", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless { context.cluster.cloudProviders == [ResourcePolicy::CloudProvider::\"gcp\"] };" } ] } ``` The following example uses the `when` clause to prevent users from creating or editing a cluster in the project with ID `6217f7fff7957854e2d09179` unless Google Cloud is the only cloud provider: ```text { "name": "Policy Allowing Only GCP Clusters for One Project", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { resource in ResourcePolicy::Project::\"6217f7fff7957854e2d09179\" && context.cluster.cloudProviders == [ResourcePolicy::CloudProvider::\"gcp\"] };" } ] } ``` The following example prevents modifications to the cluster with ID `3217e2gdf79a4c54e2d0827` when Google Cloud is the cloud provider: ```text { "name": "Forbid Modifications to Specific GCP Cluster", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { resource in ResourcePolicy::Project::\"65dcbf5ccd12a54df59a54e6\" && resource == ResourcePolicy::Cluster::\"670968dfc0a2297ef46bc02a\" && context.cluster.cloudProviders == [ResourcePolicy::CloudProvider::\"gcp\"]};" } ] } ``` ### Restrict Cloud Provider Region The following example prevents users from creating or editing a cluster in the region `aws:us-east-1`: ```text { "name": "Prohibit Cluster Deployment in the US-EAST-1 Region", "policies": [ { "body": "forbid (principal,action == ResourcePolicy::Action::\"cluster.modify\",resource) when {context.cluster.regions.contains(ResourcePolicy::Region::\"aws:us-east-1\")};" } ] } ``` The following example prevents users from creating a cluster in the region `aws:us-west-1`: ```text { "name": "Policy Preventing Clusters in AWS:us-west-1", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.regions.contains(ResourcePolicy::Region::\"aws:us-west-1\") };" } ] } ``` The following example prevents users from creating a cluster in the regions `aws:us-east-1`, `aws:us-west-1`, or `azure:westeurope`: ```text { "name": "Policy Preventing Clusters in 3 AWS Regions", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.regions.containsAny([ResourcePolicy::Region::\"aws:us-east-1\", ResourcePolicy::Region::\"aws:us-west-1\", ResourcePolicy::Region::\"azure:westeurope\"]) };" } ] } ``` The following example uses the `unless` clause to allow users to create clusters *only* in the regions `aws:us-east-1` and `azure:westeurope`: ```text { "name": "Policy Allowing Clusters Only in 2 AWS Regions", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless { [ResourcePolicy::Region::\"aws:us-east-1\", ResourcePolicy::Region::\"azure:westeurope\"].containsAll(context.cluster.regions) };" } ] } ``` The following example uses the `when` clause to restrict users from editing the cluster with ID `3217e2gdf79a4c54e2d0827` in the regions `aws:us-east-1` and `aws:us-west-1`: ```text { "name": "Policy Restricting Edits to One Cluster from 2 AWS Regions", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource == ResourcePolicy::Cluster::\"3217e2gdf79a4c54e2d0827\") when { context.cluster.regions.containsAny([ResourcePolicy::Region::\"aws:us-east-1\",ResourcePolicy::Region::\"aws:us-west-1\"]) };" } ] } ``` ### Restrict Cloud Provider and Region The following example restricts Atlas users from creating Atlas clusters on Google Cloud, or in the AWS (Amazon Web Services) regions `aws:us-east-1` or `aws:us-west-1`. ```text { "name": "Policy Restricting All GCP Clusters and Some AWS Regions", "policies": [ { "body": "forbid (principal,action == ResourcePolicy::Action::\"cluster.modify\", resource) when {context.cluster.cloudProviders.containsAny([ResourcePolicy::CloudProvider::\"gcp\"]) || context.cluster.regions.containsAny([ResourcePolicy::Region::\"aws:us-east-1\", ResourcePolicy::Region::\"aws:us-west-1\"])};"} } ] } ``` ### Restrict IP Addresses **Note:** If you add to a project access list any IPv4 `/0` CIDR, such as `0.0.0.0/0` or `10.0.0.0/0`, Atlas sends an alert email to all users directly granted a role to the project, or indirectly granted a role through team membership (if the team is granted a role to the project). The following example prevents users from editing a project from a wildcard IP (`0.0.0.0/0`). Atlas treats any IPv4 `/0` CIDR as a wildcard equivalent to `0.0.0.0/0`, so this policy also blocks entries like `10.0.0.0/0` or `1.2.3.4/0`.: ```text { "name": "Policy Restricting Wildcard IP", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"project.ipAccessList.modify\", resource) when { context.project.ipAccessList.contains(ip(\"0.0.0.0/0\")) };" } ] } ``` The following example uses the `unless` clause to allow connections *only* from the IP addresses `1.2.3.4/32`, `8.8.8.8/32`, and `4.4.4.4/32`: ```text { "name": "Policy Restricting Project Edits to Specified IPs", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"project.ipAccessList.modify\", resource) unless { [ip(\"1.2.3.4/32\"), ip(\"8.8.8.8/32\"), ip(\"4.4.4.4/32\")].containsAll(context.project.ipAccessList) };" } ] } ``` The following example ensures that all traffic to the cluster is prohibited over public networks by requiring the IP access list to be empty. ```text { "name": "Policy Preventing Access Over Public Networks", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.ipAccessList.modify\", resource) unless {context.project.ipAccessList.isEmpty() };" } ] } ``` ### Restrict Cluster Tier Sizes The following example uses the `when` clause to restrict Atlas from provisioning or scaling clusters to less than `M30` or greater than `M60`: **Note:** This policy doesn't restrict clusters with a [cluster class](https://www.mongodb.com/docs/atlas/customize-storage.md#std-label-storage-class-ui) of **Low CPU** or **NVMe SSD**. ```text { "name": "Policy Restricting Min/Max Cluster Size", "policies": [ { "body": "forbid(principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { (context.cluster has minGeneralClassInstanceSizeValue && context.cluster.minGeneralClassInstanceSizeValue < 30) || (context.cluster has maxGeneralClassInstanceSizeValue && context.cluster.maxGeneralClassInstanceSizeValue > 60) };" } ] } ``` ### Restrict Atlas Embedding and Reranking API Service for Projects The following example restricts access to the [Atlas Embedding and Reranking API](https://www.mongodb.com/docs/voyageai/api-reference/overview.md#std-label-voyage-api-overview) for all projects in an organization. This effectively prevents users from creating [model API keys](https://www.mongodb.com/docs/voyageai/management/api-keys.md#std-label-voyage-api-keys) for any projects in the organization. ```text { "name": "Policy Restricting ERAS Access for All Projects", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.aiModelAPI.modify\", resource);" } ] } ``` You can specify projects as exceptions using the policy's `unless` clause. The following example restricts access to the Embedding and Reranking API for all projects in an organization *except* the project with ID `6217f7fff7957854e2d09179`: ```text { "name": "Policy Restricting ERAS Access for All Projects Except One", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.aiModelAPI.modify\", resource) unless { resource in ResourcePolicy::Project::\"6217f7fff7957854e2d09179\" };" } ] } ``` You can also limit the [Geographies](https://www.mongodb.com/docs/atlas/geographies.md#std-label-atlas-geographies) that users can scope model API keys to. The following example allows users to create model API keys only for the Europe Geography: ```text { "name": "Policy Restricting ERAS Access to the Europe Geography", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.aiModelAPI.modify\", resource) unless { context.aiModelApi.geography == ResourcePolicy::Geography::\"eu\" };" } ] } ``` ### Require Project Maintenance Windows The following example requires that a project has a [maintenance window](https://www.mongodb.com/docs/atlas/tutorial/cluster-maintenance-window.md#std-label-configure-maintenance-window) configured: ```text { "name": "Policy Enforcing Existence of a Project Maintenance Window", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.maintenanceWindow.modify\", resource) when {context.project.hasDefinedMaintenanceWindow == false};" } ] } ``` ### Require Database Auditing The following example requires that database auditing is enabled on a project before clusters can be created or modified: ```text { "name": "Require database auditing", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { !context.project.databaseAuditing.enabled };" } ] } ``` ### Require Customer-Managed Keys on All Clusters The following example requires that Customer-Managed Keys for encryption at rest are enabled on all clusters in a project: ```text { "name": "Require CMK on clusters", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { !context.cluster.encryptionAtRest.customerManagedKey.enabled };" } ] } ``` ### Require Customer-Managed Keys on All Dedicated Search Deployments The following example requires that Customer-Managed Keys for encryption at rest are enabled on all dedicated search deployments in a project: ```text { "name": "Require CMK on search deployments", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"search.deployment.modify\", resource) when { !context.search.encryptionAtRest.customerManagedKey.enabled };" } ] } ``` ### Enforce Customer-Managed Keys on All Organization Data (AWS Only) The following example enforces Customer-Managed Keys on all organization data (clusters and search nodes) and restricts deployments to AWS (Amazon Web Services) only. Three policies must be applied together: **Policy 1:** Require CMK on all clusters in this project ```text { "name": "Require CMK on clusters", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { !context.cluster.encryptionAtRest.customerManagedKey.enabled };" } ] } ``` **Policy 2:** Require CMK on all search deployments in this project ```text { "name": "Require CMK on search deployments", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"search.deployment.modify\", resource) when { !context.search.encryptionAtRest.customerManagedKey.enabled };" } ] } ``` **Policy 3:** Restrict clusters and search deployments to AWS (Amazon Web Services) only ```text { "name": "Restrict to AWS only", "policies": [ { "body": "forbid (principal, action in [ResourcePolicy::Action::\"cluster.modify\", ResourcePolicy::Action::\"search.deployment.modify\"], resource) when { !([ResourcePolicy::CloudProvider::\"aws\"].containsAll(context.cluster.cloudProviders)) };" } ] } ``` **Note:** Search nodes inherit encryption from their cluster, so enforcing CMK on data at rest also requires the cluster itself to use CMK. Both clusters and search deployments can be deployed on different cloud providers. Today, only AWS (Amazon Web Services) supports search-node CMK, which is why all three policies are needed to ensure complete coverage. ### Prevent Modifications to Network Peering The following example prevents modifications to VPC (Virtual Private Cloud) peering connections across different cloud providers (AWS (Amazon Web Services), Google Cloud, Azure (Microsoft Azure)). Each cloud provider requires different details for VPC (Virtual Private Cloud) peering. Gather the following details for your cloud provider and replace them in the example: **AWS:** `aws:::` - `AWS_ACCOUNT_ID`: Your AWS (Amazon Web Services) account number. - `VPC_ID`: The ID of the VPC (Virtual Private Cloud). - `VPC_CIDR`: The CIDR (Classless Inter-Domain Routing) block of the VPC (Virtual Private Cloud). **Azure:** `azure:::` - `SUBSCRIPTION_ID`: Your Azure (Microsoft Azure) subscription ID. - `RESOURCE_GROUP_NAME`: The resource group in which your Virtual Network (VNet) exists. - `VNET_NAME`: The name of your VNet. **Google Cloud:** `gcp::` - `GCP_PROJECT_ID`: The ID of your Google Cloud project. - `VPC_NAME`: The name of the VPC (Virtual Private Cloud) in Google Cloud. ```text { "name": "Policy Preventing Modifications to Peering Across Providers", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.vpcPeering.modify\", resource) when {context.project.peeringConnections == [\"aws:000123456789:vpc-0316c47cc923ce313:10.0.0.0/16\", \"azure:fd01aafc-b3re-2193-8497-83lp3m83a1a5:rg-name:vnet\", \"gcp:inductive-cocoa-108200:default\"]};" } ] } ``` ### Prevent Modifications to Private Endpoints The following example prevents modifications to private endpoint connections across cloud providers (AWS (Amazon Web Services), Google Cloud, Azure (Microsoft Azure)). Each cloud provider requires different details for private endpoints. Gather the following details for your cloud provider and replace them in the example: **AWS:** `aws:` - `VPC_ENDPOINT_ID`: The ID of the AWS (Amazon Web Services) VPC (Virtual Private Cloud) endpoint. **Azure:** `azure::` - `PRIVATE_ENDPOINT_RESOURCE_ID`: The full resource ID path of the Azure (Microsoft Azure) private endpoint. - `PRIVATE_ENDPOINT_IP_ADDRESS`: The IP address assigned to the private endpoint. **Google Cloud:** `gcp::` - `GCP_PROJECT_ID`: The ID of your Google Cloud project. - `VPC_NAME`: The name of the VPC (Virtual Private Cloud) in Google Cloud associated with the connection. ```text { "name": "Policy Preventing Modifications to Private Endpoints Across Providers", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.privateEndpoint.modify\", resource) when {context.project.privateEndpoints == [\"aws:vpce-042d72ded1748f314\", \"azure:/subscriptions/fd01aafc-b3re-2193-8497-83lp3m83a1a5/resourceGroups/rg-name/providers/Microsoft.Network/privateEndpoints/pe-name:10.0.0.4\", \"gcp:inductive-cocoa-108200:default\"]};" } ] } ``` ### Restrict TLS (Transport Layer Security) Protocol and Cipher Suites The following example restricts the minimum TLS (Transport Layer Security) version that your cluster accepts for incoming connections to TLS (Transport Layer Security) 1.3. Possible values for `minTLSVersion` include: - **TLS 1.2**: `ResourcePolicy::TLSVersion::\"tls1_2\"` - **TLS 1.3**: `ResourcePolicy::TLSVersion::\"tls1_3\"` ```text { "name": "Policy Restricting Cluster Connections to Minimum TLS 1.3", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless {context.cluster.minTLSVersion == ResourcePolicy::TLSVersion::\"tls1_2\"};" } ] } ``` The following example requires that clusters use the custom TLS (Transport Layer Security) cipher suite configuration `TLS_AES_256_GCM_SHA384\` by setting `ResourcePolicy::CipherConfigMode::\"custom\"`. Possible values for custom TLS (Transport Layer Security) cipher suite configurations are: - `ResourcePolicy::CipherSuite::\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\"` - `ResourcePolicy::CipherSuite::\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\"` - `ResourcePolicy::CipherSuite::\"TLS_AES_256_GCM_SHA384\"` - `ResourcePolicy::CipherSuite::\"TLS_CHACHA20_POLY1305_SHA256\"` - `ResourcePolicy::CipherSuite::\"TLS_AES_128_GCM_SHA256\"` - `ResourcePolicy::CipherSuite::\"TLS_AES_128_CCM_SHA256\"` ```text { "name": "Policy Requiring Specific TLS Cipher Suite", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless {context.cluster.cipherConfigMode == ResourcePolicy::CipherConfigMode::\"custom\" && context.cluster.cipherSuites == [ResourcePolicy::CipherSuite::\"TLS_AES_256_GCM_SHA384\"]};" } ] } ``` The following example requires that clusters use the default TLS (Transport Layer Security) cipher suite configuration. ```text { "name": "Policy Requiring Default TLS Cipher Suite", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless {context.cluster.cipherConfigMode == ResourcePolicy::CipherConfigMode::\"default\"};" } ] } ``` ### Enforce Disk Size (GB) The following example enforces a maximum disk size of 4 TB by forbidding any value greater than (`>`) the limit. To prevent creating clusters smaller than a certain size, use a less-than operator (`<`) in your forbid policy. ```text { "name": "Limit Max Disk Size to 4000GB", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster has diskSizeGB && context.cluster.diskSizeGB > 4096 };" } ] } ``` ### Enforce Cluster Topology (Replica Set, Sharded, or Global Cluster) The following example enables users to create *only* replica set clusters. ```text { "name": "Require Replica Set Clusters", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) unless { context.cluster.clusterType == ResourcePolicy::ClusterType::\"replicaset\" };" } ] } ``` To allow a different cluster topology, use one of the following values: - **Sharded Cluster**: `ResourcePolicy::ClusterType::"sharded"` Used for standard horizontal scaling, where data is distributed across multiple shards to support large datasets or high throughput. - **Global Cluster**: `ResourcePolicy::ClusterType::"geosharded"` Used for location-aware deployments, where data is distributed across specific geographic zones to ensure data resides close to users. ### Enforce Minimum Shard Count The following example requires that sharded clusters have at least three shards. **Important:** - If you enforce a minimum shard count greater than one, you must explicitly allow the transition state for cluster conversions in your policy (for example, `&& !context.cluster.isConvertingToSharded`). Without this exception, Atlas blocks users from converting a replica set to a sharded cluster because the conversion process requires an intermediate state where the cluster has only one shard. - Atlas treats a replica set as having a shard count of one. If you enforce a minimum shard count greater than one without checking whether clusters are sharded clusters, all replica sets in the project are marked as non-compliant. - Use `minShardCount` to enforce *minimums* only (for example, `< 3`) and `maxShardCount` to enforce *maximums* only (for example, `> 10`). Using opposite comparison operators with these properties causes policy evaluation errors. ```text { "name": "Require Minimum 3 Shards", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.minShardCount < 3 && !context.cluster.isConvertingToSharded };" } ] } ``` ### Enforce Dedicated Config Servers for Sharded Clusters The following example prevents users from creating sharded clusters with [embedded config servers](https://www.mongodb.com/docs/atlas/cluster-additional-settings.md#std-label-nodes-for-config-server), ensuring they use dedicated config servers from the start. ```text { "name": "Enforce config server management mode to fixed_to_dedicated for sharded clusters", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"cluster.modify\", resource) when { context.cluster.clusterType == ResourcePolicy::ClusterType::\"sharded\" && context.cluster has configServerManagementMode && context.cluster.configServerManagementMode != ResourcePolicy::ConfigServerManagementMode::\"fixed_to_dedicated\" };" } ] } ``` ### Restrict MongoDB Search Index Operations **Note:** The `search.index.modify` action restricts only creation and modification of MongoDB Search indexes. Atlas always allows deletion of MongoDB Search indexes. The following example prevents users from adding or editing MongoDB Search indexes unless dedicated MongoDB Search nodes exist: ```text { "name": "Require Search Nodes Before Adding Search Indexes", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"search.index.modify\", resource) when { !context.search.hasDedicatedNodes };" } ] } ``` ### Restrict Automated Embedding for MongoDB Vector Search The following example prevents users from creating or modifying search indexes that use `autoEmbed` type. This allows you to restrict the use of Automated Embedding for compliance or cost governance while still permitting creation of `vector` type indexes. ```text { "name": "Prevent Automated Embedding Indexes", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"search.index.modify\", resource) when { context.search.index.isAutoEmbed };" } ] } ``` The following example prevents users from adding or editing MongoDB Search indexes unless dedicated MongoDB Search nodes exist and are all on AWS (Amazon Web Services): ```text { "name": "Require Search Nodes on AWS Before Adding Search Indexes", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"search.index.modify\", resource) when { !context.search.hasDedicatedNodes || !([ResourcePolicy::CloudProvider::\"aws\"].containsAll(context.cluster.cloudProviders)) };" } ] } ``` ### Restrict MongoDB Search Deployment Operations The following example prevents users from removing dedicated MongoDB Search nodes from a cluster that has MongoDB Search indexes: ```text { "name": "Prevent Removing Search Nodes When Indexes Exist", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"search.deployment.modify\", resource) when { context.search.hasIndexes && !context.search.hasDedicatedNodes };" } ] } ``` The following example prevents deploying MongoDB Search to non-AWS (Amazon Web Services) providers on a cluster that has MongoDB Search indexes: ```text { "name": "Prevent Non-AWS Search Deployment When Indexes Exist", "policies": [ { "body": "forbid (principal, action in [ResourcePolicy::Action::\"cluster.modify\", ResourcePolicy::Action::\"search.deployment.modify\"], resource) when { context.search.hasIndexes && !([ResourcePolicy::CloudProvider::\"aws\"].containsAll(context.cluster.cloudProviders)) };" } ] } ``` ### Restrict Native Reranking The following example prevents users from enabling Native Reranking (the `$rerank` aggregation stage) for any project in the organization. This policy prevents projects from enabling Native Reranking, but does not disable `$rerank` for projects that already have it enabled. To disable Native Reranking for a project that already has it enabled, see [Enable or Disable Native Reranking.](https://www.mongodb.com/docs/vector-search/query/native-reranking/managing.md#std-label-rerank-enable-disable) ```text { "name": "Restrict Native Reranking", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.rerank.modify\", resource) when { context.project.rerankEnabled == true };" } ] } ``` To allow Native Reranking for specific projects, use the `unless` clause to exclude them: ```text { "name": "Restrict Native Reranking with Exceptions", "policies": [ { "body": "forbid (principal, action == ResourcePolicy::Action::\"project.rerank.modify\", resource) when { context.project.rerankEnabled == true } unless { resource in ResourcePolicy::Project::\"\" };" } ] } ```