> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Set Up a Private Endpoint for Online Archives MongoDB supports AWS (Amazon Web Services) and Azure (Microsoft Azure) private endpoints for Online Archives. You can set up the private endpoints from the Atlas UI and Atlas Administration API. **Note:** You can set up private endpoints for a dedicated cluster. To learn more, see [Configure Private Endpoints.](https://www.mongodb.com/docs/atlas/security-configure-private-endpoints.md#std-label-private-endpoint) ## Required Access To set up a private endpoint for an Online Archive, you must have [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) access or higher to the project. ## Prerequisites 1. Have an AWS (Amazon Web Services) user account with an IAM (Identity and Access Management) user policy that grants permissions to create, modify, describe, and delete endpoints. For more information on controlling the use of interface endpoints, see the [AWS Documentation.](http://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html) 2. [Install the AWS CLI.](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) 3. If you have not already done so, create your VPC (Virtual Private Cloud) and EC2 instances in AWS (Amazon Web Services). See the [AWS documentation](http://docs.aws.amazon.com/index.html) for guidance. 1) Have an AWS (Amazon Web Services) user account with an IAM (Identity and Access Management) user policy that grants permissions to create, modify, describe, and delete endpoints. For more information on controlling the use of interface endpoints, see the [AWS Documentation.](http://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html) 2) [Install the AWS CLI.](http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) 3) If you have not already done so, create your VPC (Virtual Private Cloud) and EC2 instances in AWS (Amazon Web Services). See the [AWS documentation](http://docs.aws.amazon.com/index.html) for guidance. 1. Have an Azure (Microsoft Azure) user account with permissions to create resources like virtual networks and private endpoints. To learn more about the permissions required, see the [Azure Documentation.](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) 2. [Install the Azure CLI.](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) **Important:** With Azure (Microsoft Azure), you can create *up to three private endpoints per project* for an Online Archive due to an Azure (Microsoft Azure)-imposed limit. This is why Atlas prevents you from deleting an Atlas project before first deleting its private endpoints. To request more than three private endpoints for a project, contact [MongoDB Support.](https://www.mongodb.com/docs/atlas/support.md#std-label-request-support) 1) Have an Azure (Microsoft Azure) user account with permissions to create resources like virtual networks and private endpoints. To learn more about the permissions required, see the [Azure Documentation.](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) 2) [Install the Azure CLI.](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) **Important:** With Azure (Microsoft Azure), you can create *up to three private endpoints per project* for an Online Archive due to an Azure (Microsoft Azure)-imposed limit. This is why Atlas prevents you from deleting an Atlas project before first deleting its private endpoints. To request more than three private endpoints for a project, contact [MongoDB Support.](https://www.mongodb.com/docs/atlas/support.md#std-label-request-support) **Note:** You can't use your Atlas cluster [private endpoint ID](https://www.mongodb.com/docs/atlas/security-configure-private-endpoints.md#std-label-private-endpoint) for an Online Archive. The Online Archive endpoint ID must be different from your Atlas cluster endpoint ID, if you have one. ## Procedure You can create a new private endpoint for an Online Archive through your Atlas UI. To set up the private endpoint: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Navigate to the private endpoint for your federated database instance or online archive. In the sidebar, click Private Endpoint. Click the Federated Database Instance / Online Archive tab. 3. Click the Add Private Endpoint button. 4. Choose a cloud provider and region. Click the AWS button. Click Next. From the Choose a region list, select the region where you want to create the private endpoint. You can select one of the following regions: | Data Federation Region | AWS (Amazon Web Services) Region | Atlas Region | | --- | --- | --- | | Northern Virginia, USA | `us-east-1` | `US_EAST_1` | | Oregon, USA | `us-west-2` | `US_WEST_2` | | Sao Paulo, Brazil | `sa-east-1` | `SA_EAST_1` | | Ireland | `eu-west-1` | `EU_WEST_1` | | London, England, UK | `eu-west-2` | `EU_WEST_2` | | Frankfurt, Germany | `eu-central-1` | `EU_CENTRAL_1` | | Tokyo, Japan | `ap-northeast-1` | `AP_NORTHEAST_1` | | Seoul, South Korea | `ap-northeast-2` | `AP_NORTHEAST_2` | | Mumbai, India | `ap-south-1` | `AP_SOUTH_1` | | Singapore | `ap-southeast-1` | `AP_SOUTHEAST_1` | | Sydney, Australia | `ap-southeast-2` | `AP_SOUTHEAST_2` | | Montreal, QC, Canada | `ca-central-1` | `CA_CENTRAL_1` | To learn more, see [Atlas Data Federation Regions.](https://www.mongodb.com/docs/atlas/data-federation/adf-overview/regions.md#std-label-atlas-data-federation-regions) Click Next. **Note:** If your organization has no payment information stored, Atlas prompts you to add it before continuing. 5. Configure your private endpoint. **Tip:** Click Show instruction in the Atlas UI to display a screenshot of the console detailing where to find the value for a specific setting. Enter the your AWS (Amazon Web Services) VPC (Virtual Private Cloud) details: WARNING: To avoid connection interruptions, you must specify the correct information. We recommend that you don't skip the commands and substeps in this step. | VPC ID | Unique, 22-character alphanumeric string identifier of the peer AWS (Amazon Web Services) Virtual Private Cloud (VPC (Virtual Private Cloud)). Find this value on the VPC (Virtual Private Cloud) dashboard in your AWS (Amazon Web Services) account. | | --- | --- | | Subnet IDs | Unique identifiers of the subnets your AWS (Amazon Web Services) VPC (Virtual Private Cloud) uses. Find these values on the Subnet dashboard in your AWS (Amazon Web Services) account. IMPORTANT: You must specify at least one subnet. If you don't, AWS (Amazon Web Services) won't provision an [interface endpoint](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint) in your VPC (Virtual Private Cloud). An interface endpoint is required for clients in your VPC (Virtual Private Cloud) to send traffic to the private endpoint. | Click the Next button. The Atlas UI displays a dialog box with a command with the new endpint's details. Copy the command the in the dialog box and run it using the AWS (Amazon Web Services) CLI. AWS creates the new endpoint for your VPC (Virtual Private Cloud). Alternatively, you can create the private endpoint using the AWS (Amazon Web Services) console: 1. Enter your VPC Endpoint ID that identifies your private endpoint. Find this value on the AWS (Amazon Web Services) VPC (Virtual Private Cloud) Dashboard under Endpoints > VPC ID. 2. Enter your DNS Name associated with your private endpoint on AWS (Amazon Web Services) in the Your VPC Endpoint DNS Name field. If you have multiple DNS names for your private endpoint, copy and paste the first name from your list. To learn more, see [Manage DNS names for VPC endpoint services.](http://docs.aws.amazon.com/vpc/latest/privatelink/manage-dns-names.html) See [create-vpc-endpoint](http://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpc-endpoint.html) in the AWS documentation for more details on creating VPC (Virtual Private Cloud) endpoints through the AWS interface. 3. If required, modify the private DNS (Domain Name System) name to ensure that the hostname resolves to an address on your network. 6. Click the Finish button. You can add an existing private endpoint for an Online Archive through your Atlas UI. To set up the private endpoint: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Navigate to the private endpoint for your federated database instance or online archive. In the sidebar, click Private Endpoint. Click the Federated Database Instance / Online Archive tab. 3. Click the Connect existing endpoint button. 4. Select AWS (Amazon Web Services) as cloud provider. 5. Enter your AWS (Amazon Web Services) VPC (Virtual Private Cloud) details: | Region | Region where your endpoint is located. | | --- | --- | | VPC ID | Unique, 22-character alphanumeric string identifier of the peer AWS (Amazon Web Services) Virtual Private Cloud (VPC (Virtual Private Cloud)). Find this value on the VPC (Virtual Private Cloud) dashboard in your AWS (Amazon Web Services) account. | | Comment | Optional comment to associate with this endpoint, such as subnet ID, VPC (Virtual Private Cloud) ID, AWS (Amazon Web Services) region, or other useful information. | | DNS Hostname | Enter the alpha-numeric DNS hostname associated with your private endpoint on AWS (Amazon Web Services) in the Your VPC Endpoint DNS Name field. If you have multiple DNS names for your private endpoint, copy and paste the first name from your list. To learn more, see [Manage DNS names for VPC endpoint services.](http://docs.aws.amazon.com/vpc/latest/privatelink/manage-dns-names.html) | **Tip:** Click and expand Show more instructions in the dialog box for a visual clue as to where you can find the necessary information in the AWS (Amazon Web Services) console. 6. Add a comment to associate with this endpoint. You can enter your subnet ID, VPC (Virtual Private Cloud) ID, AWS (Amazon Web Services) region, and other information to associate with this endpoint here. 7. Click Confirm to add the existing private endpoint. You can create a new private endpoint for an Online Archive through your Atlas UI. To set up the private endpoint: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Navigate to the private endpoint for your federated database instance or online archive. In the sidebar, click Private Endpoint. Click the Federated Database Instance / Online Archive tab. 3. Click the Create New Endpoint button. 4. Choose a cloud provider and region. Click the Azure button. From the dropdown, select the region where you want to create the private endpoint. You can select one of the following regions: | Data Federation Region | Azure (Microsoft Azure) Region | Atlas Region | | --- | --- | --- | | Virginia, USA | `eastus2` | `US_EAST_2` | | Sao Paulo, Brazil | `brazilsouth` | `BRAZIL_SOUTH` | | Netherlands | `westeurope` | `EUROPE_WEST` | To learn more, see [Atlas Data Federation Regions.](https://www.mongodb.com/docs/atlas/data-federation/adf-overview/regions.md#std-label-atlas-data-federation-regions) Click the Next button. 5. Configure your private endpoint. Enter the following details about your Azure (Microsoft Azure) private endpoint: **Tip:** Click Show instruction in the Atlas UI to display a screenshot of the console detailing where to find the value for a specific setting. | Resource Group Name | Name of the Azure (Microsoft Azure) resource group that contains the VNet that you want to use to connect to Atlas. Find this value in your Azure (Microsoft Azure) account. | | --- | --- | | Virtual Network Name | Name of the VNet that you want to use to connect to Atlas. Find this value in your Azure (Microsoft Azure) account. | | Subnet ID | Identifier of the subnet in your Azure (Microsoft Azure) VNet. Find this value in your Azure (Microsoft Azure) account. | | Private Endpoint Name | Unique alphanumeric string that identifies the private endpoint within your Azure (Microsoft Azure) resource group. Any private endpoint name that exceeds 24 characters is automatically transformed into a unique identifier in your private endpoint URI (Uniform Resource Identifier) [connection string.](https://www.mongodb.com/docs/atlas/data-federation/tutorial/connect.md#std-label-gst-connect-adf) | Click the Next button. Copy the command the dialog box displays and run it using the Azure (Microsoft Azure) CLI. **Note:** You can't copy the command until Atlas finishes creating virtual network resources in the background. Click Finish. You can add an existing private endpoint for an Online Archive through your Atlas UI. To set up the private endpoint: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Navigate to the private endpoint for your federated database instance or online archive. In the sidebar, click Private Endpoint. Click the Federated Database Instance / Online Archive tab. 3. Click the Connect Existing Endpoint button. 4. Select Azure (Microsoft Azure) as cloud provider. 5. Enter your Azure (Microsoft Azure) endpoint details: | Region | Region where your endpoint is located. | | --- | --- | | Private Endpoint ID | Unique alphanumeric string identifier of the Azure (Microsoft Azure) Endpoint. Find this value on the Azure (Microsoft Azure) Private Endpoints dashboard in your Azure (Microsoft Azure) account. | | Comment | Optional comment to associate with this endpoint, such as subnet ID, VPC (Virtual Private Cloud) ID, Azure (Microsoft Azure) region, or other useful information. | | Endpoint Private IP Address | You Private IP Address can be found in the Azure Private Endpoints Dashboard. | **Tip:** Click Show instruction in the Atlas UI to display a screenshot of the console detailing where to find the value for a specific setting. 6. Click the Confirm button to add the existing private endpoint. To configure a private endpoint for an online archive from the API, send a `POST` request with the private endpoint ID to the [privateNetworkSettings](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroupprivatenetworksettingendpointid) endpoint. - If the endpoint ID already exists and there is no change to the comment associated with the endpoint, Atlas makes no change to the endpoint ID list. - If the endpoint ID already exists and there is a change to the associated comment, Atlas updates the `comment` value only in the endpoint ID list. - If the endpoint ID doesn't exist, Atlas appends the new endpoint to the list of endpoints in the endpoint ID list. To learn more about the syntax and options, see [API.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroupprivatenetworksettingendpointid) To configure a private endpoint for an online archive from the API, send a `POST` request with the private endpoint ID to the [privateNetworkSettings](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroupprivatenetworksettingendpointid) endpoint. - If the endpoint ID already exists and there is no change to the comment associated with the endpoint, Atlas makes no change to the endpoint ID list. - If the endpoint ID already exists and there is a change to the associated comment, Atlas updates the `comment` value only in the endpoint ID list. - If the endpoint ID doesn't exist, Atlas appends the new endpoint to the list of endpoints in the endpoint ID list. To learn more about the syntax and options, see [API.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroupprivatenetworksettingendpointid)