> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Set Up a Network Peering Connection **Note:** This page applies to both Atlas Infinite and Atlas Core. Use this page to set up, view, and remove network peering connections between your Atlas project and your cloud provider network. For an overview of network peering, including limitations and best practices, see [Network Peering.](https://www.mongodb.com/docs/atlas/security-vpc-peering.md#std-label-vpc-peering) **Note:** The MongoDB Atlas Shared Responsibility Model defines the complementary duties of MongoDB and its customers in maintaining a secure and resilient data environment. Under this framework, MongoDB manages the security and operational integrity of the underlying platform, while customers are responsible for the configuration, management, and data policies of their specific deployments. For a detailed breakdown of ownership across security and operational excellence, see [Shared Responsibility Model.](https://www.mongodb.com/resources/products/fundamentals/shared-responsibility) ## Required Access To set up a network peering connection, you must have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner), [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner), or [`Project Network Access Manager`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Network-Access-Manager) access to the project. ## Limitations - Atlas does not support network peering between clusters deployed in a single region on different cloud providers. For example, you cannot set up network peering between an Atlas cluster hosted in a single region on AWS (Amazon Web Services) and an application hosted in a single region on Google Cloud. - Free clusters (formerly known as `M0`) and Flex clusters do not support VPC peering. To use private networking, you must use a [dedicated cluster.](https://www.mongodb.com/docs/atlas/create-database-deployment.md#std-label-ref-deployment-types) ## Configure an Atlas Network Peering Connection To configure Atlas network peering for a cluster, complete the steps for your interface and your cluster's cloud provider. You also configure the Atlas VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) during this procedure. ### Considerations #### DNS Configuration DNS (Domain Name System) resolves the cluster's hostnames to their public IP (Internet Protocol) address rather than their internal IP (Internet Protocol) address if: - DNS hostnames are disabled, - DNS resolution is disabled, and - The user accesses the Atlas cluster from outside a peered [VPC.](https://www.mongodb.com/docs/atlas/setup-cluster-security.md#std-label-security-vpc) To learn more about how to enable these options, see [Updating DNS Support for Your VPC.](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html#vpc-dns-updating) AWS (Amazon Web Services) supports standard connection strings for configuring peering. Use a private connection string only if the applications within AWS (Amazon Web Services) use custom DNS (Domain Name System) services. For more information, see [VPC](https://www.mongodb.com/docs/atlas/setup-cluster-security.md#std-label-security-vpc) and read [the Connection Strings FAQ.](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-custom-dns) #### Deployments in Multiple Regions Atlas deployments in multiple regions must have a peering connection for each Atlas region. For example: If you have a VPC (Virtual Private Cloud) in Sydney and Atlas deployments in Sydney and Singapore, create two peering connections. ### AWS VPC Peering Prerequisites Create the following network traffic rule on your AWS (Amazon Web Services) security group attached to your resources that connect to Atlas: | Permission | Direction | Port | Target | | --- | --- | --- | --- | | Allow | outbound | 27015-27017 inclusive | to your Atlas CIDR (Classless Inter-Domain Routing) | ### Configure Network Peering for an AWS-backed Cluster To configure Atlas VPC (Virtual Private Cloud) peering for an AWS (Amazon Web Services)-backed cluster: 1. In AWS (Amazon Web Services), enable DNS hostnames and DNS resolution. Log in to your AWS (Amazon Web Services) account. Go to the [VPC dashboard](https://console.aws.amazon.com/vpc). Open your list of VPC (Virtual Private Cloud) resources. Select the VPC (Virtual Private Cloud) you want to peer with. Enable DNS hostnames and DNS resolution. These settings ensure that when your application connects to the cluster within the [VPC](https://www.mongodb.com/docs/atlas/setup-cluster-security.md#std-label-security-vpc) it uses private IP addresses. 2. Add a new network peering connection for your project. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. In the Peering tab, click Add outbound connection. 3. In Atlas, configure your network peering connection. **Important:** Atlas does not support adding AWS (Amazon Web Services) security groups of cross-region peered VPC (Virtual Private Cloud)s to IP access lists. Instead, use the CIDR (Classless Inter-Domain Routing) block of the peer VPC. To learn more about this limitation, see the [AWS documentation.](http://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html) To learn more about CIDR (Classless Inter-Domain Routing) blocks, see [RFC 4632.](https://tools.ietf.org/html/4632) In the Peering Connection modal, select AWS and click Next. Atlas displays the Peering Connection modal. Fill out the fields in the Your Application VPC section. | Field | Description | | --- | --- | | Account ID | Unique number that identifies the AWS (Amazon Web Services) Account ID of the owner of the peer VPC (Virtual Private Cloud). To find your AWS Account ID, click Learn More. | | VPC ID | Unique string that starts with `vpc-` that identifies the peer VPC (Virtual Private Cloud). To find your VPC ID, click Learn More. | | VPC CIDR | AWS (Amazon Web Services) VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block or subset of the network in which your application runs. This range cannot overlap with your Atlas CIDR Block or any other network peering connection VPC CIDR. The CIDR (Classless Inter-Domain Routing) block must be in one of the following [private networks:](https://tools.ietf.org/html/rfc1918#section-3) Lower BoundUpper BoundExample`10.0.0.0``10.255.255.255``10.0.0.0/24``172.16.0.0``172.31.255.255``172.20.0.0/22``192.168.0.0``192.168.255.255``192.168.248.0/21` To include this VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block in your IP access list, click Add this CIDR block to my IP access list. You can choose to add the [Security Group associated](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-add-to-access-list) with the AWS (Amazon Web Services) VPC (Virtual Private Cloud). To learn more about CIDR (Classless Inter-Domain Routing) blocks, see [RFC 4632.](https://tools.ietf.org/html/4632) | | Application VPC Region | AWS (Amazon Web Services) region where the AWS (Amazon Web Services) VPC (Virtual Private Cloud) resides. | Fill out the fields in the Your Atlas VPC section. | Field | Description | | --- | --- | | Atlas VPC Region | AWS (Amazon Web Services) region where the Atlas VPC (Virtual Private Cloud) resides. Atlas creates a VPC (Virtual Private Cloud) for the Atlas project in your chosen region if that region has no `M10` or greater clusters or VPC (Virtual Private Cloud) peering connections. Clear Same as application VPC region to select a region different from where your application's VPC (Virtual Private Cloud) resides. | | VPC CIDR | Atlas uses this Atlas CIDR (Classless Inter-Domain Routing) block for all other network peering connections created in the project. The Atlas CIDR (Classless Inter-Domain Routing) block must be at least a `/24` and at most a `/21` in one of the following [private networks.](https://tools.ietf.org/html/rfc1918#section-3) Lower BoundUpper BoundExample`10.0.0.0``10.255.255.255``10.0.0.0/24``172.16.0.0``172.31.255.255``172.20.0.0/22``192.168.0.0``192.168.255.255``192.168.248.0/21` Atlas locks this value for a given region if an `M10` or greater cluster or a network peering connection already exists in that region. To modify the CIDR (Classless Inter-Domain Routing) block, the target project cannot have: Any `M10` or greater clusters with nodes in the target region; Any cloud backup snapshots stored in the target region; Any other VPC (Virtual Private Cloud) peering connections to the target region You can also [create a new project](https://www.mongodb.com/docs/atlas/reference/faq/accounts.md#std-label-atlas-create-atlas-project) then create a network peering connection to set the desired Atlas VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block for that project. IMPORTANT: Atlas limits the number of MongoDB nodes per network peering connection based on the CIDR (Classless Inter-Domain Routing) block and the region selected for the project: For example, a project in an AWS (Amazon Web Services) region supporting 3 availability zones and a Atlas CIDR (Classless Inter-Domain Routing) VPC (Virtual Private Cloud) block of `/24` is limited to the equivalent of 27 three-node replica sets.; Contact [MongoDB Support](https://www.mongodb.com/contact?tck=docs) for any questions on Atlas limits of MongoDB nodes per VPC (Virtual Private Cloud). | Click Initiate Peering. Wait for approval of peering connection request. The owner of the peer VPC (Virtual Private Cloud) must approve the VPC (Virtual Private Cloud) peering connection request. Ensure that the owner approves the request. Atlas provides instructions for approving the connection request. **Important: Requests expire after 7 days.** 4. In AWS (Amazon Web Services), update your VPC's route table. In the VPC Dashboard, click Route Tables. Select the Route Table for your VPC (Virtual Private Cloud) or subnets. Click the Routes tab. Click Edit Routes. Click Add route. Add the Atlas VPC (Virtual Private Cloud)'s CIDR (Classless Inter-Domain Routing) block to the Destination column. Add the AWS Peering Connection ID to the Target column. This value uses a prefix of `pcx-`. Click Save. **Note:** Each Atlas project may have a maximum of 50 peering connections in total. This total includes a maximum of 25 pending peering connections. Once set up, you can edit or terminate VPC (Virtual Private Cloud) peering connection from the Peering table. Before your new VPC (Virtual Private Cloud) peer can connect to your Atlas cluster, you must: - Locate the VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block addresses (or subset), or the Security Groups, associated with the VPC (Virtual Private Cloud) configured in your project. - Add at least one of these CIDR (Classless Inter-Domain Routing) blocks to the [access list.](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) ### Connect to Atlas from an Application Deployed in AWS After you have configured the VPC peering connection and added the appropriate CIDR (Classless Inter-Domain Routing) blocks to your access list, you can connect to your Atlas cluster using the standard connection string. 1. Get your connection string. In the Atlas UI, select your cluster, and click Connect. Select your preferred connection method. Copy your connection string. 2. Update your application running in AWS (Amazon Web Services). Add your connection string to your deployed application. The application automatically uses the peered VPC network when connecting to Atlas. **See also:** - To learn about changes to AWS (Amazon Web Services) network peering, see [31 March 2020 Release.](https://www.mongodb.com/docs/atlas/release-notes/changelog.md#std-label-atlas_20200331) - To learn more about private connection strings, see [Private Connection Strings.](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-connstring-private) ### Considerations #### DNS Configuration DNS (Domain Name System) resolves the cluster's hostnames to their public IP (Internet Protocol) address rather than their internal IP (Internet Protocol) address if: - DNS hostnames are disabled, - DNS resolution is disabled, and - The user accesses the Atlas cluster from outside a peered [VPC.](https://www.mongodb.com/docs/atlas/setup-cluster-security.md#std-label-security-vpc) To learn more about how to enable these options, see [Updating DNS Support for Your VPC.](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-dns.html#vpc-dns-updating) AWS (Amazon Web Services) supports standard connection strings for configuring peering. Use a private connection string only if the applications within AWS (Amazon Web Services) use custom DNS (Domain Name System) services. For more information, see [VPC](https://www.mongodb.com/docs/atlas/setup-cluster-security.md#std-label-security-vpc) and read [the Connection Strings FAQ.](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-custom-dns) #### Deployments in Multiple Regions Atlas deployments in multiple regions must have a peering connection for each Atlas region. For example: If you have a VPC (Virtual Private Cloud) in Sydney and Atlas deployments in Sydney and Singapore, create two peering connections. ### AWS VPC Peering Prerequisites Create the following network traffic rule on your AWS (Amazon Web Services) security group attached to your resources that connect to Atlas: | Permission | Direction | Port | Target | | --- | --- | --- | --- | | Allow | outbound | 27015-27017 inclusive | to your Atlas CIDR (Classless Inter-Domain Routing) | ### Configure Network Peering for an AWS-backed Cluster To configure Atlas VPC (Virtual Private Cloud) peering for an AWS (Amazon Web Services)-backed cluster: 1. In AWS (Amazon Web Services), enable DNS hostnames and DNS resolution. Log in to your AWS (Amazon Web Services) account. Go to the [VPC dashboard](https://console.aws.amazon.com/vpc). Open your list of VPC (Virtual Private Cloud) resources. Select the VPC (Virtual Private Cloud) you want to peer with. Enable DNS hostnames and DNS resolution. These settings ensure that when your application connects to the cluster within the [VPC](https://www.mongodb.com/docs/atlas/setup-cluster-security.md#std-label-security-vpc) it uses private IP addresses. 2. In Atlas, configure your network peering connection. **Important:** Atlas does not support adding AWS (Amazon Web Services) security groups of cross-region peered VPC (Virtual Private Cloud)s to IP access lists. Instead, use the CIDR (Classless Inter-Domain Routing) block of the peer VPC. To learn more about this limitation, see the [AWS documentation.](http://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html) To learn more about CIDR (Classless Inter-Domain Routing) blocks, see [RFC 4632.](https://tools.ietf.org/html/4632) To create a network peering connection with AWS using the Atlas CLI, run the following command: ```sh atlas networking peering create aws [options] ``` To watch for a peering connection to become available using the Atlas CLI, run the following command: ```sh atlas networking peering watch [options] ``` To learn more about the syntax and parameters for the previous commands, see the Atlas CLI documentation for [atlas networking peering create aws](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-create-aws/) and [atlas networking peering watch.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-watch/) **See also: Related Links** - [Install the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/install-atlas-cli/) - [Connect to the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli/) 3. In AWS (Amazon Web Services), update your VPC's route table. In the VPC Dashboard, click Route Tables. Select the Route Table for your VPC (Virtual Private Cloud) or subnets. Click the Routes tab. Click Edit Routes. Click Add route. Add the Atlas VPC (Virtual Private Cloud)'s CIDR (Classless Inter-Domain Routing) block to the Destination column. Add the AWS Peering Connection ID to the Target column. This value uses a prefix of `pcx-`. Click Save. **Note:** Each Atlas project may have a maximum of 50 peering connections in total. This total includes a maximum of 25 pending peering connections. Once set up, you can edit or terminate VPC (Virtual Private Cloud) peering connection from the Peering table. Before your new VPC (Virtual Private Cloud) peer can connect to your Atlas cluster, you must: - Locate the VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block addresses (or subset), or the Security Groups, associated with the VPC (Virtual Private Cloud) configured in your project. - Add at least one of these CIDR (Classless Inter-Domain Routing) blocks to the [access list.](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) ### Connect to Atlas from an Application Deployed in AWS After you have configured the VPC peering connection and added the appropriate CIDR (Classless Inter-Domain Routing) blocks to your access list, you can connect to your Atlas cluster using the standard connection string. 1. Get your connection string. In the Atlas UI, select your cluster, and click Connect. Select your preferred connection method. Copy your connection string. 2. Update your application running in AWS (Amazon Web Services). Add your connection string to your deployed application. The application automatically uses the peered VPC network when connecting to Atlas. **See also:** - To learn about changes to AWS (Amazon Web Services) network peering, see [31 March 2020 Release.](https://www.mongodb.com/docs/atlas/release-notes/changelog.md#std-label-atlas_20200331) - To learn more about private connection strings, see [Private Connection Strings.](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-connstring-private) ### Considerations VPC (Virtual Private Cloud) peering connections Atlas have the following limitations: - Google Kubernetes Engine (GKE) supports two network modes: routes-based and VPC-native. While VPC-native GKE clusters can connect to Atlas clusters, route-based GKE clusters can't connect to Atlas clusters via peering because Atlas doesn't accept custom routes when VPC (Virtual Private Cloud) peering connections are created. Consider using Public IP allow lists for route-based GKE clusters. - Google App Engine (Standard), Cloud Functions, and Cloud Run can't connect to Atlas clusters over VPC (Virtual Private Cloud) peering connections. To connect over VPC (Virtual Private Cloud) peering, these services require a serverless VPC (Virtual Private Cloud) Access connector. - Clients can't connect to Atlas clusters with Google Cloud VPN (Virtual Private Network) or Interconnect because Atlas doesn't accept custom routes when VPC (Virtual Private Cloud) peering connections are created. Consider creating [private endpoints.](https://www.mongodb.com/docs/atlas/security-configure-private-endpoints.md#std-label-private-endpoint) ### Configure VPC Peering for a GCP-backed Cluster To configure Atlas VPC (Virtual Private Cloud) Peering for a Google Cloud-backed cluster: 1. Add a new network peering connection for your project. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. In the Peering tab, click New Peering Connection. 2. In Atlas, configure your network peering connection. **Note:** Since Google Cloud uses global VPCs, you need to create only one peering connection. In the Peering Connection modal, select Google Cloud Platform and click Next. To create the VPC (Virtual Private Cloud) Peering connection, fill in the requested information in the Peering Connection modal: | Field | Description | | --- | --- | | Project ID | Google Cloud Project ID of the peer VPC (Virtual Private Cloud). Refer to the dialog box for instructions on finding your GCP Project ID. | | VPC Name | Name of the peer VPC (Virtual Private Cloud). Refer to the dialog box for instructions on finding your VPC Name. | | Atlas CIDR | CIDR (Classless Inter-Domain Routing) block for your Atlas cluster. Atlas uses the specified CIDR (Classless Inter-Domain Routing) block for all other network peering connections created in the project. By default, the Atlas CIDR (Classless Inter-Domain Routing) block must be at least an `/18` in one of the following [private networks.](https://tools.ietf.org/html/rfc1918#section-3) Lower BoundUpper BoundPrefix`10.0.0.0``10.255.255.255`10/8`172.16.0.0``172.31.255.255`172.16/12`192.168.0.0``192.168.255.255`192.168/16 If your application requires Atlas to use a smaller CIDR (Classless Inter-Domain Routing) block, use the Atlas [API](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroupcontainer) to create an Atlas network peering container with a CIDR (Classless Inter-Domain Routing) block of `/21` to `/24`. When you choose a smaller CIDR (Classless Inter-Domain Routing) block, the IP address space of the CIDR (Classless Inter-Domain Routing) block you choose is distributed evenly across the Google Cloud regions to which you deploy the network peering container. Atlas requires a CIDR (Classless Inter-Domain Routing) block of `/24` for each region. Refer to the following table to learn the number of regions to which you can deploy a network peering container based on the CIDR (Classless Inter-Domain Routing) block you choose. CIDR (Classless Inter-Domain Routing) BlockNumber of Google Cloud Regions`/21`1 - 8`/22`1 - 4`/23`1 - 2`/24`1 IMPORTANT: You can't use the Atlas user interface to specify an Atlas CIDR (Classless Inter-Domain Routing) block smaller than `/18`. You must use the Atlas [API](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroupcontainer) and specify the regions (up to eight, based on the CIDR (Classless Inter-Domain Routing) block you choose) to which to deploy the network peering container. You can deploy Atlas clusters only to these regions in this project. Atlas locks this value for all regions if an `M10` or greater cluster or a network peering connection already exists in that project. To modify the CIDR (Classless Inter-Domain Routing) block, the target project cannot have: Any `M10` or greater clusters; Any other VPC (Virtual Private Cloud) peering connections Alternatively, [create a new project](https://www.mongodb.com/docs/atlas/reference/faq/accounts.md#std-label-atlas-create-atlas-project) and create a network peering connection to set the desired Atlas network peering CIDR (Classless Inter-Domain Routing) block for that project. IMPORTANT: Atlas limits the number of MongoDB nodes per network peering connection based on the CIDR (Classless Inter-Domain Routing) block and the region selected for the project. For example, a project with an Atlas VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block of `/18` is limited to approximately 80 three-node replica sets per Google Cloud region. Contact [MongoDB Support](https://www.mongodb.com/contact?tck=docs) for any questions on Atlas limits of MongoDB nodes per network peering connection. | Click Initiate Peering. 3. In Google Cloud, create the peering connection. In the Google Cloud Console, click VPC network peering. Click Create Connection. Click Continue. In Name, enter a name for your peering connection. In Your VPC Network, enter the name of your Google Cloud VPC (Virtual Private Cloud) network. In Peered VPC network, select In another project. In Project ID, enter your Atlas GCP Project ID. To find this name in the VPC (Virtual Private Cloud) Peering view in Atlas. In the Security section of the left navigation: In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. Click the Peering tab. In VPC network name, enter your Atlas VPC (Virtual Private Cloud) Name. To find this name in the VPC (Virtual Private Cloud) Peering view in Atlas: In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. Click the Peering tab. **Note:** Each Atlas project may have a maximum of 50 peering connections in total. This total includes a maximum of 25 pending peering connections. You must add your VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block address (or subset) associated with the peer VPC (Virtual Private Cloud) to the [IP access list](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) before your new VPC (Virtual Private Cloud) peer can connect to your Atlas cluster. When connecting to your cluster, you must use the new [private connection strings](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-connstring-private) to utilize the peering. **See also:** [Auto mode IP ranges.](https://cloud.google.com/vpc/docs/vpc#ip-ranges) ### Rolling Back a Google Cloud Container with a Restricted Set of Regions After a Google Cloud container with a restricted set of regions is generated, that project is locked into that set of regions. Any attempts to use other regions will generate an error message similar to what you find below: ```text There are no more regions supported with your existing configuration. Try changing to a different cluster tier or changing your region configuration. ``` To resolve this error, follow this general process: 1. [Remove all clusters from the Google Cloud container.](https://www.mongodb.com/docs/atlas/pause-terminate-cluster.md#std-label-terminate-cluster) 2. Delete the Google Cloud container using the Atlas Administration API. See [Remove One Network Peering Container.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-deletepeeringcontainer) 3. Create a new Google Cloud container without restricted regions with an Atlas CIDR block of at least `/18` using the Atlas Administration API. See [Create a New Network Peering Container.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-createpeeringcontainer) ### Considerations VPC (Virtual Private Cloud) peering connections Atlas have the following limitations: - Google Kubernetes Engine (GKE) supports two network modes: routes-based and VPC-native. While VPC-native GKE clusters can connect to Atlas clusters, route-based GKE clusters can't connect to Atlas clusters via peering because Atlas doesn't accept custom routes when VPC (Virtual Private Cloud) peering connections are created. Consider using Public IP allow lists for route-based GKE clusters. - Google App Engine (Standard), Cloud Functions, and Cloud Run can't connect to Atlas clusters over VPC (Virtual Private Cloud) peering connections. To connect over VPC (Virtual Private Cloud) peering, these services require a serverless VPC (Virtual Private Cloud) Access connector. - Clients can't connect to Atlas clusters with Google Cloud VPN (Virtual Private Network) or Interconnect because Atlas doesn't accept custom routes when VPC (Virtual Private Cloud) peering connections are created. Consider creating [private endpoints.](https://www.mongodb.com/docs/atlas/security-configure-private-endpoints.md#std-label-private-endpoint) ### Configure VPC Peering for a GCP-backed Cluster To configure Atlas VPC (Virtual Private Cloud) Peering for a Google Cloud-backed cluster: 1. In Atlas, configure your network peering connection. **Note:** Since Google Cloud uses global VPCs, you need to create only one peering connection. To create a network peering connection with Google Cloud using the Atlas CLI, run the following command: ```sh atlas networking peering create gcp [options] ``` To watch for a peering connection to become available using the Atlas CLI, run the following command: ```sh atlas networking peering watch [options] ``` To learn more about the syntax and parameters for the previous commands, see the Atlas CLI documentation for [atlas networking peering create gcp](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-create-gcp/) and [atlas networking peering watch.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-watch/) **See also: Related Links** - [Install the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/install-atlas-cli/) - [Connect to the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli/) 2. In Google Cloud, create the peering connection. In the Google Cloud Console, click VPC network peering. Click Create Connection. Click Continue. In Name, enter a name for your peering connection. In Your VPC Network, enter the name of your Google Cloud VPC (Virtual Private Cloud) network. In Peered VPC network, select In another project. In Project ID, enter your Atlas GCP Project ID. To find this name in the VPC (Virtual Private Cloud) Peering view in Atlas. In the Security section of the left navigation: In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. Click the Peering tab. In VPC network name, enter your Atlas VPC (Virtual Private Cloud) Name. To find this name in the VPC (Virtual Private Cloud) Peering view in Atlas: In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. Click the Peering tab. **Note:** Each Atlas project may have a maximum of 50 peering connections in total. This total includes a maximum of 25 pending peering connections. You must add your VPC (Virtual Private Cloud) CIDR (Classless Inter-Domain Routing) block address (or subset) associated with the peer VPC (Virtual Private Cloud) to the [IP access list](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) before your new VPC (Virtual Private Cloud) peer can connect to your Atlas cluster. When connecting to your cluster, you must use the new [private connection strings](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-connstring-private) to utilize the peering. **See also:** [Auto mode IP ranges.](https://cloud.google.com/vpc/docs/vpc#ip-ranges) ### Rolling Back a Google Cloud Container with a Restricted Set of Regions After a Google Cloud container with a restricted set of regions is generated, that project is locked into that set of regions. Any attempts to use other regions will generate an error message similar to what you find below: ```text There are no more regions supported with your existing configuration. Try changing to a different cluster tier or changing your region configuration. ``` To resolve this error, follow this general process: 1. [Remove all clusters from the Google Cloud container.](https://www.mongodb.com/docs/atlas/pause-terminate-cluster.md#std-label-terminate-cluster) 2. Delete the Google Cloud container using the Atlas Administration API. See [Remove One Network Peering Container.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-deletepeeringcontainer) 3. Create a new Google Cloud container without restricted regions with an Atlas CIDR block of at least `/18` using the Atlas Administration API. See [Create a New Network Peering Container.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-createpeeringcontainer) **Note:** Effective March 31, 2020, Atlas has removed the **Peering-Only Mode** limitations for all existing and new Azure clusters. To learn how to use these new features, see the [FAQ on changes to Azure network peering](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-azure-gcp-peering-only) ### Azure Roles Required to Configure a Network Peering Connection To learn the Azure (Microsoft Azure) roles that you need to create a Network Peering connection, see the [Azure documentation.](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#permissions) ### Configure Network Peering for an Azure-backed Cluster To configure network peering for an Azure (Microsoft Azure)-backed cluster: 1. Add a new network peering connection for your project. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. In the Peering tab, click Add outbound connection. 2. In Atlas, configure your network peering connection. **Important:** For multi-region Azure clusters, you must create a peering connection for each Atlas region from your application's regional VNET. For example, if you have an application VNET in Sydney, another application VNET in Singapore, and Atlas nodes deployed in both regions, with the primary node deployed in Sydney, you need to cross peer the application VNET in Singapore to the Atlas VNET in Sydney, in addition to the Atlas VNET in Singapore, in order to establish a successful connection between the application in Singapore and the primary node. To configure the Atlas region, fill in the Atlas Vnet Region field in the Peering Connection modal. In the Peering Connection modal, select Azure and click Next. To create the network peering connection, fill in the requested information: | Field | Description | | --- | --- | | Subscription ID | Unique identifier for your Azure subscription. You can find this information on the Overview tab of your Azure Virtual networks dashboard. | | Directory ID | Unique identifier of your Azure directory. You can find this information on the Properties tab of your Microsoft Entra ID dashboard. | | Resource Group Name | Unique identifier of the Azure resource group to which the virtual network belongs. You can find this information on the Overview tab of your Azure virtual network. | | VNet Name | Name of your Azure virtual network. You can find this information on the Virtual networks dashboard. | | Atlas CIDR | CIDR (Classless Inter-Domain Routing) block for your Atlas cluster. Atlas uses the specified CIDR (Classless Inter-Domain Routing) block for all other network peering connections created in the project. You can't create peering connection if a peer with an overlapping CIDR (Classless Inter-Domain Routing) block already exists. The Atlas CIDR (Classless Inter-Domain Routing) block must be at least `/24` and at most `/21` in one of the following [private networks.](https://tools.ietf.org/html/rfc1918#section-3) Lower BoundUpper BoundPrefix`10.0.0.0``10.255.255.255`10/8`172.16.0.0``172.31.255.255`172.16/12`192.168.0.0``192.168.255.255`192.168/16 Atlas locks this value for a given region if an `M10` or greater cluster or a network peering connection already exists in that region. To modify the CIDR (Classless Inter-Domain Routing) block, the target project cannot have: Any `M10` or greater clusters with nodes in the target region; Any cloud backup snapshots stored in the target region; Any other VPC (Virtual Private Cloud) peering connections to the target region Alternatively, [create a new project](https://www.mongodb.com/docs/atlas/reference/faq/accounts.md#std-label-atlas-create-atlas-project) and create a network peering connection to set the desired Atlas network peering CIDR (Classless Inter-Domain Routing) block for that project. IMPORTANT: Atlas limits the number of MongoDB nodes per Network Peering connection based on the CIDR (Classless Inter-Domain Routing) block and the region selected for the project. Contact [MongoDB Support](https://www.mongodb.com/contact?tck=docs) for any questions on Atlas limits of MongoDB nodes per VPC (Virtual Private Cloud). | | Atlas VNet Region | Azure region in which your Atlas cluster resides. | Click Next. 3. In Azure (Microsoft Azure), create the peering request. You must grant Atlas the following permissions on the virtual network. You can revoke these permissions after the VNet peering has been established. - `Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read` - `Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write` - `Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete` - `Microsoft.Network/virtualNetworks/peer/action` To grant Atlas permission to create a peering connection with your Azure virtual network: Launch the Azure console. Run the commands from the Peering Connection modal to create a service principal, create a new custom role, and assign the custom role to the service principal. **Note:** Run the first command to create a service principal only once for all Azure VNets from the same Azure subscription. Click Validate. Click Initiate Peering. You must add the CIDR (Classless Inter-Domain Routing) block address (or subset) associated with the peer VNet to the [whitelist](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) before your network peer can connect to your Atlas cluster. When connecting to your cluster, you must use the new [private connection string](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-connstring-private) to utilize the peering. **Note:** Effective March 31, 2020, Atlas has removed the **Peering-Only Mode** limitations for all existing and new Azure clusters. To learn how to use these new features, see the [FAQ on changes to Azure network peering](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-azure-gcp-peering-only) ### Azure Roles Required to Configure a Network Peering Connection To learn the Azure (Microsoft Azure) roles that you need to create a Network Peering connection, see the [Azure documentation.](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#permissions) ### Configure Network Peering for an Azure-backed Cluster To configure network peering for an Azure (Microsoft Azure)-backed cluster: 1. In Atlas, configure your network peering connection. **Important:** For multi-region Azure clusters, you must create a peering connection for each Atlas region from your application's regional VNET. For example, if you have an application VNET in Sydney, another application VNET in Singapore, and Atlas nodes deployed in both regions, with the primary node deployed in Sydney, you need to cross peer the application VNET in Singapore to the Atlas VNET in Sydney, in addition to the Atlas VNET in Singapore, in order to establish a successful connection between the application in Singapore and the primary node. To create a network peering connection with Azure using the Atlas CLI, run the following command: ```sh atlas networking peering create azure [options] ``` To watch for a peering connection to become available using the Atlas CLI, run the following command: ```sh atlas networking peering watch [options] ``` To learn more about the syntax and parameters for the previous commands, see the Atlas CLI documentation for [atlas networking peering create azure](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-create-azure/) and [atlas networking peering watch.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-watch/) **See also: Related Links** - [Install the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/install-atlas-cli/) - [Connect to the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli/) 2. In Azure (Microsoft Azure), create the peering request. You must grant Atlas the following permissions on the virtual network. You can revoke these permissions after the VNet peering has been established. - `Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read` - `Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write` - `Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete` - `Microsoft.Network/virtualNetworks/peer/action` To grant Atlas permission to create a peering connection with your Azure virtual network: Launch the Azure console. Run the commands from the Peering Connection modal to create a service principal, create a new custom role, and assign the custom role to the service principal. **Note:** Run the first command to create a service principal only once for all Azure VNets from the same Azure subscription. Click Validate. Click Initiate Peering. You must add the CIDR (Classless Inter-Domain Routing) block address (or subset) associated with the peer VNet to the [whitelist](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-access-list) before your network peer can connect to your Atlas cluster. When connecting to your cluster, you must use the new [private connection string](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-atlas-faq-connstring-private) to utilize the peering. ## View Atlas Network Peering Connections To view your network peering connections using the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Click the Peering tab. Atlas displays your network peering connections. To return the details for all network peering connections in the project you specify using the Atlas CLI, run the following command: ```sh atlas networking peering list [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas networking peering list.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-list/) To view your network peering connections using the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Click the Peering tab. Atlas displays your network peering connections. To return the details for all network peering connections in the project you specify using the Atlas CLI, run the following command: ```sh atlas networking peering list [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas networking peering list.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-list/) To view your network peering connections using the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Click the Peering tab. Atlas displays your network peering connections. To return the details for all network peering connections in the project you specify using the Atlas CLI, run the following command: ```sh atlas networking peering list [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas networking peering list.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-list/) ## Remove an Atlas Network Peering Connection To remove your network peering connection using the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Click the Peering tab. Atlas displays your network peering connections. 3. Remove the network peering connection. Click TERMINATE next to the network peering connection that you want to remove. Click Yes, Terminate to confirm the removal. To delete the network peering connection you specify using the Atlas CLI, run the following command: ```sh atlas networking peering delete [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas networking peering delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-delete/) To remove your network peering connection using the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Click the Peering tab. Atlas displays your network peering connections. 3. Remove the network peering connection. Click TERMINATE next to the network peering connection that you want to remove. Click Yes, Terminate to confirm the removal. To delete the network peering connection you specify using the Atlas CLI, run the following command: ```sh atlas networking peering delete [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas networking peering delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-delete/) To remove your network peering connection using the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Click the Peering tab. Atlas displays your network peering connections. 3. Remove the network peering connection. Click TERMINATE next to the network peering connection that you want to remove. Click Yes, Terminate to confirm the removal. To delete the network peering connection you specify using the Atlas CLI, run the following command: ```sh atlas networking peering delete [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas networking peering delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-networking-peering-delete/)