> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Set Up a Private Endpoint for a Dedicated Cluster Non-port-mapped GCP private endpoints are deprecated and will be disabled on **April 30, 2027**. After this date, you will not be able to create new non-port-mapped endpoints and existing endpoints will stop working. Create new GCP endpoint services that use port-mapping architecture to reduce IP usage and improve scalability. To learn how to convert legacy endpoints to port-mapping, see [Converting Legacy Private Endpoints to use Port Mapping Architecture](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-gcp-convert-legacy-to-port-mapping). **Note:** This page applies to both Atlas Infinite and Atlas Core. Follow these steps to enable a client to connect to a Atlas dedicated cluster using private endpoints. To learn more about using private endpoints with Atlas, see [Learn About Private Endpoints in Atlas.](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-private-endpoint-overview) **Note:** This feature is available for `M10` clusters or higher. To learn more about which features are available for Free clusters, see [Atlas Free Cluster Limits](https://www.mongodb.com/docs/atlas/reference/free-shared-limitations.md#std-label-atlas-free-tier), and for Flex clusters, see [Atlas Flex Limitations.](https://www.mongodb.com/docs/atlas/reference/flex-limitations.md#std-label-flex-cluster-limitations) ## Required Access To set up a private endpoint for a dedicated cluster, you must have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) or [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) access to the project. ## Prerequisites, Considerations, and Limitations To learn the prerequisites, considerations, and limitations for setting up a private endpoint, see the following resources: - [Prerequisites](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-atlas-pl-prereqs) - [Considerations](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-private-endpoint-considerations) - [Limitations](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-atlas-pl-limitations) ## Follow These Steps To set up AWS PrivateLink through the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Navigate to the private endpoint for your dedicated cluster. In the sidebar, click Private Endpoint. Click the Dedicated Cluster tab. 3. Create an endpoint service. Click the Create Endpoint Service button. IMPORTANT: You must provide the billing information in the Edit Payment Method form if you don't have payment method already configured for your organization. Click the AWS (Amazon Web Services) logo to select your cloud provider. From the Atlas Region list, select the primary region where your Atlas cluster is deployed. Optional: In the Accepted Endpoint Regions section, select additional AWS (Amazon Web Services) regions from which you want to allow endpoint connections. This enables cross-region private endpoint connectivity. **Note:** The primary region is automatically included as an accepted region and cannot be removed. You can add or remove additional regions at any time. To learn more, see [Manage Accepted Endpoint Regions.](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-manage-accepted-endpoint-regions) Click Create Endpoint Service. The endpoint service creation process takes approximately 3-5 minutes. IMPORTANT: If your organization has no payment information stored, Atlas prompts you to add it before continuing. 4. Add an endpoint to your endpoint service. After the endpoint service is created, you can add endpoints to connect your AWS (Amazon Web Services) VPC (Virtual Private Cloud) to the service. On the endpoint service card, click the Add Endpoint button. Choose how you want to add the endpoint: - **Create New Endpoint**: Create a new AWS (Amazon Web Services) interface endpoint using the provided AWS (Amazon Web Services) CLI command. - **Connect Existing Endpoint**: Connect an existing AWS (Amazon Web Services) interface endpoint that you have already created. 5. Create a new endpoint or connect an existing endpoint. To create a new endpoint: Select Create New Endpoint. Enter the following details about your AWS (Amazon Web Services) VPC (Virtual Private Cloud): | Your VPC ID | Unique identifier of the peer AWS (Amazon Web Services) VPC (Virtual Private Cloud). Find this value on the VPC (Virtual Private Cloud) dashboard in your AWS (Amazon Web Services) account. | | --- | --- | | Your Subnet IDs | Unique identifiers of the subnets your AWS (Amazon Web Services) VPC (Virtual Private Cloud) uses. Find these values on the Subnet dashboard in your AWS (Amazon Web Services) account. You must specify at least one subnet. If you don't, AWS (Amazon Web Services) won't provision an [interface endpoint](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint) in your VPC (Virtual Private Cloud). An interface endpoint is required for clients in your VPC (Virtual Private Cloud) to send traffic to the private endpoint. | | Interface Endpoint Region | AWS (Amazon Web Services) region where you want to create your VPC (Virtual Private Cloud) [interface endpoint](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint). This region must be one of the accepted endpoint regions configured for the endpoint service. | Click Create Endpoint. Atlas provides an AWS (Amazon Web Services) CLI command pre-filled with your configuration. Copy the AWS (Amazon Web Services) CLI command and run it in your terminal. IMPORTANT: You must have the necessary AWS (Amazon Web Services) permissions to create interface endpoints. Ensure that the endpoint is in the `Pending Acceptance` state in your AWS (Amazon Web Services) console before proceeding. See [Creating an Interface Endpoint](http://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint) for more information. After running the command, copy the resulting VPC Endpoint ID from the AWS (Amazon Web Services) CLI output. This is a 22-character alphanumeric string (for example, `vpce-0123456789abcdef0`). Paste the VPC Endpoint ID into the modal and click Add Endpoint. Atlas accepts the endpoint connection. This process typically takes a few minutes. When the endpoint is ready, the endpoint status displays as Available. To connect an existing endpoint that you have already created in AWS (Amazon Web Services): Select Connect Existing Endpoint. Enter your VPC Endpoint ID. This is a 22-character alphanumeric string that identifies your AWS (Amazon Web Services) interface endpoint (for example, `vpce-0123456789abcdef0`). Find this value on the AWS (Amazon Web Services) VPC Dashboard under Endpoints > VPC ID. Click Submit Endpoint. Atlas validates and links the endpoint to your private endpoint service. 6. Configure your resources' security groups to send traffic to and receive traffic from the [interface endpoint](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint). For each resource that needs to connect to your Atlas clusters using AWS PrivateLink, the resource's security group must allow outbound traffic to the [interface endpoint's](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint) private IP addresses on all ports (1024-65535). See [Adding Rules to a Security Group](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#adding-security-group-rule) for more information. 7. Create a security group for your interface endpoint to allow resources to access it. This security group must allow inbound traffic on all ports from each resource that needs to connect to your Atlas clusters using AWS PrivateLink: In the AWS (Amazon Web Services) console, navigate to the VPC Dashboard. Click Security Groups, then click Create security group. Use the wizard to create a security group. Make sure you select your VPC from the VPC list. Select the security group you just created, then click the Inbound Rules tab. Click Edit Rules. Add rules to allow all inbound traffic from each resource in your VPC that you want to connect to your Atlas cluster. Click Save Rules. Click Endpoints, then click the endpoint for your VPC. Click the Security Groups tab, then click Edit Security Groups. Add the security group you just created, then click Save. To learn more about [VPC security groups](http://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html), see the AWS (Amazon Web Services) documentation. 8. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 9. Verify that the private endpoint is available. You can connect to an Atlas cluster using the AWS PrivateLink private endpoint when all of the resources are configured and the private endpoint becomes available. To verify that the AWS PrivateLink private endpoint is available: On the Private Endpoint page, select a cluster type and verify the following statuses for the region that contains the cluster you want to connect to using AWS PrivateLink: | Atlas Endpoint Service Status | Available | | --- | --- | | Endpoint Status | Available | To learn more about possible status values, see [Troubleshoot Private Endpoint Connection Issues.](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) If you do not see these statuses, see [Troubleshoot Private Endpoint Connection Issues](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) for additional information. **Note:** If you encounter issues with endpoint connections, including failed endpoints or missing regions, see [Troubleshoot Private Endpoint Connection Issues](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) for troubleshooting steps and common resolutions. To learn more about cross-region private endpoint connectivity, accepted endpoint regions, and limitations, see [Manage Accepted Endpoint Regions.](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-manage-accepted-endpoint-regions) To set up Azure Private Link through the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Navigate to the private endpoint for your dedicated cluster. In the sidebar, click Private Endpoint. Click the Dedicated Cluster tab. 3. Create an endpoint service. Click the Create Endpoint Service button. IMPORTANT: You must provide the billing information in the Edit Payment Method form if you don't have payment method already configured for your organization. Click the Azure (Microsoft Azure) logo to select your cloud provider. From the Atlas Region list, select the primary region where your Atlas cluster is deployed. Click Create Endpoint Service. The endpoint service creation process takes approximately 3-5 minutes. IMPORTANT: If your organization has no payment information stored, Atlas prompts you to add it before continuing. 4. Configure your private endpoint. WARNING: To avoid connection interruptions, you must specify the correct information. We recommend that you don't skip the commands and substeps in this step. Enter the following details about your Azure (Microsoft Azure) VNet: | Resource Group Name | The name of the resource group that contains the VNet that you want to use to connect to Atlas. Find this value on the Resource Group Properties page on your Azure (Microsoft Azure) dashboard. | | --- | --- | | Virtual Network Name | The name of the VNet that you want to use to connect to Atlas. Find this value on the Virtual Network page on your Azure (Microsoft Azure) dashboard. | | Subnet Name | The name of the subnet in your Azure (Microsoft Azure) VNet. Find this value on the Virtual Network Subnets page on your Azure (Microsoft Azure) dashboard. | Enter a unique name for your private endpoint in the Private Endpoint Name field. From the Private Endpoint Region list, select the Azure (Microsoft Azure) region where you want to create your private endpoint. This region must match the region of the application that connects through the endpoint, but it doesn't need to match the region of your Atlas cluster. Create the private endpoint in your VNet by copying the `az network private-endpoint create` command the dialog box displays and running it using the Azure (Microsoft Azure) CLI. IMPORTANT: You can't copy the command until Atlas finishes creating VNet resources in the background. For more information about this command, see the [Azure documentation.](https://docs.microsoft.com/en-us/cli/azure/network/private-endpoint?view=azure-cli-latest#az_network_private_endpoint_create) You might receive an error like the following when you create the private endpoint: ```sh ServiceError: code: LinkedAuthorizationFailed - , The client has permission to perform action 'Microsoft.Network/privateLinkServices/PrivateEndpointConnectionsApproval/action' on scope '/subscriptions//resourceGroups/privatelink/providers/Microsoft.Network/privateEndpoints/privatelink', however the current tenant '' is not authorized to access linked subscription ''. ``` If you receive this error, you must add the `--manual-request true` parameter to the Azure (Microsoft Azure) CLI command you used to create the private endpoint, then run the command again. Click Next. 5. Finalize your private endpoint connection. WARNING: To avoid connection interruptions, you must specify the correct information. We recommend that you don't skip the commands and substeps in this step. Enter the following details about your private endpoint: | Private Endpoint Resource ID | The unique identifier of the private endpoint you created in your Azure (Microsoft Azure) VNet. Find this value in one of the following ways: The Properties page for your private endpoint on your Azure (Microsoft Azure) dashboard displays this property in the Resource ID field.; The output from the following command that you ran earlier to create the private endpoint returns the highlighted value in the **id** field:`azure network private-endpoint create`**Output:**`{ "customDnsConfigs": [], "etag": "W/\"00000000-0000-0000-0000-000000000000\"", "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/privateEndpoints/privatelink", "location": "eastus2", "manualPrivateLinkServiceConnections": [ { "etag": "W/\"00000000-0000-0000-0000-000000000000\"", "groupIds": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/privateEndpoints/privatelink/manualPrivateLinkServiceConnections/pls_5f860388d432510d5a6e1a3e", "name": "pls_5f860388d432510d5a6e1a3e", "privateLinkServiceConnectionState": { "actionsRequired": "None", "description": "Connection deleted by service provider", "status": "Disconnected" }, "privateLinkServiceId": "pls_5f860388d432510d5a6e1a3e.00000000-0000-0000-0000-000000000000.eastus2.privatelinkservice", "provisioningState": "Succeeded", "requestMessage": null, "resourceGroup": "privatelink", "type": "Microsoft.Network/privateEndpoints/manualPrivateLinkServiceConnections" } ], "name": "privatelink", "networkInterfaces": [ { "dnsSettings": null, "dscpConfiguration": null, "enableAcceleratedNetworking": null, "enableIpForwarding": null, "etag": null, "hostedWorkloads": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/networkInterfaces/privatelink.nic.00000000-0000-0000-0000-000000000000", "ipConfigurations": null, "location": null, "macAddress": null, "name": null, "networkSecurityGroup": null, "primary": null, "privateEndpoint": null, "provisioningState": null, "resourceGroup": "privatelink", "resourceGuid": null, "tags": null, "tapConfigurations": null, "type": null, "virtualMachine": null } ], "privateLinkServiceConnections": [], "provisioningState": "Succeeded", "resourceGroup": "privatelink", "subnet": { "addressPrefix": null, "addressPrefixes": null, "delegations": null, "etag": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/virtualNetworks/privatelink/subnets/privatelink", "ipAllocations": null, "ipConfigurationProfiles": null, "ipConfigurations": null, "name": null, "natGateway": null, "networkSecurityGroup": null, "privateEndpointNetworkPolicies": null, "privateEndpoints": null, "privateLinkServiceNetworkPolicies": null, "provisioningState": null, "purpose": null, "resourceGroup": "privatelink", "resourceNavigationLinks": null, "routeTable": null, "serviceAssociationLinks": null, "serviceEndpointPolicies": null, "serviceEndpoints": null }, "tags": null, "type": "Microsoft.Network/privateEndpoints" } ` | | --- | --- | | Private Endpoint IP Address | The private IP address of the private endpoint network interface you created in your Azure (Microsoft Azure) VNet. Find this value in one of the following ways: Use the Azure (Microsoft Azure) dashboard to retrieve this value. The Overview page for your private endpoint on your Azure (Microsoft Azure) dashboard displays this property in the Private IP field.; Use the Azure (Microsoft Azure) CLI to retrieve this value:The output from the following command that you ran earlier to create the private endpoint includes the ID of the network interface in the highlighted **networkInterfaces.id** field:`azure network private-endpoint create`**Output:**`{ "customDnsConfigs": [], "etag": "W/\"00000000-0000-0000-0000-000000000000\"", "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/privateEndpoints/privatelink", "location": "eastus2", "manualPrivateLinkServiceConnections": [ { "etag": "W/\"00000000-0000-0000-0000-000000000000\"", "groupIds": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/privateEndpoints/privatelink/manualPrivateLinkServiceConnections/pls_5f860388d432510d5a6e1a3e", "name": "pls_5f860388d432510d5a6e1a3e", "privateLinkServiceConnectionState": { "actionsRequired": "None", "description": "Connection deleted by service provider", "status": "Disconnected" }, "privateLinkServiceId": "pls_5f860388d432510d5a6e1a3e.00000000-0000-0000-0000-000000000000.eastus2.privatelinkservice", "provisioningState": "Succeeded", "requestMessage": null, "resourceGroup": "privatelink", "type": "Microsoft.Network/privateEndpoints/manualPrivateLinkServiceConnections" } ], "name": "privatelink", "networkInterfaces": [ { "dnsSettings": null, "dscpConfiguration": null, "enableAcceleratedNetworking": null, "enableIpForwarding": null, "etag": null, "hostedWorkloads": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/networkInterfaces/privatelink.nic.00000000-0000-0000-0000-000000000000", "ipConfigurations": null, "location": null, "macAddress": null, "name": null, "networkSecurityGroup": null, "primary": null, "privateEndpoint": null, "provisioningState": null, "resourceGroup": "privatelink", "resourceGuid": null, "tags": null, "tapConfigurations": null, "type": null, "virtualMachine": null } ], "privateLinkServiceConnections": [], "provisioningState": "Succeeded", "resourceGroup": "privatelink", "subnet": { "addressPrefix": null, "addressPrefixes": null, "delegations": null, "etag": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/virtualNetworks/privatelink/subnets/privatelink", "ipAllocations": null, "ipConfigurationProfiles": null, "ipConfigurations": null, "name": null, "natGateway": null, "networkSecurityGroup": null, "privateEndpointNetworkPolicies": null, "privateEndpoints": null, "privateLinkServiceNetworkPolicies": null, "provisioningState": null, "purpose": null, "resourceGroup": "privatelink", "resourceNavigationLinks": null, "routeTable": null, "serviceAssociationLinks": null, "serviceEndpointPolicies": null, "serviceEndpoints": null }, "tags": null, "type": "Microsoft.Network/privateEndpoints" } `Run the [az network nic show --id {networkInterface.id}](https://docs.microsoft.com/en-us/cli/azure/network/nic?view=azure-cli-latest#az_network_nic_show) Azure (Microsoft Azure) CLI command with the value of the **networkInterfaces.id** field to retrieve the **ipConfigurations.privateIPAddress** for the private endpoint network interface. The value of this field is your Private Endpoint IP Address. The input and output should look similar to the following. Note the highlighted value of the Private Endpoint IP Address field.`az network nic show --id /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/networkInterfaces/privatelink.nic.00000000-0000-0000-0000-000000000000`**Output:**`{ "dnsSettings": { "appliedDnsServers": [], "dnsServers": [], "internalDnsNameLabel": null, "internalDomainNameSuffix": "<>.cx.internal.cloudapp.net", "internalFqdn": null }, "dscpConfiguration": null, "enableAcceleratedNetworking": false, "enableIpForwarding": false, "etag": "W/\"00000000-0000-0000-0000-000000000000\"", "hostedWorkloads": [], "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/networkInterfaces/privatelink.nic.00000000-0000-0000-0000-000000000000", "ipConfigurations": [ { "applicationGatewayBackendAddressPools": null, "applicationSecurityGroups": null, "etag": "W/\"00000000-0000-0000-0000-000000000000\"", "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/networkInterfaces/privatelink.nic.00000000-0000-0000-0000-000000000000/ipConfigurations/privateEndpointIpConfig", "loadBalancerBackendAddressPools": null, "loadBalancerInboundNatRules": null, "name": "privateEndpointIpConfig", "primary": true, "privateIpAddress": "10.0.0.4", "privateIpAddressVersion": "IPv4", "privateIpAllocationMethod": "Dynamic", "privateLinkConnectionProperties": { "fqdns": [], "groupId": "", "requiredMemberName": "" }, "provisioningState": "Succeeded", "publicIpAddress": null, "resourceGroup": "privatelink", "subnet": { "addressPrefix": null, "addressPrefixes": null, "delegations": null, "etag": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/virtualNetworks/privatelink/subnets/privatelink", "ipAllocations": null, "ipConfigurationProfiles": null, "ipConfigurations": null, "name": null, "natGateway": null, "networkSecurityGroup": null, "privateEndpointNetworkPolicies": null, "privateEndpoints": null, "privateLinkServiceNetworkPolicies": null, "provisioningState": null, "purpose": null, "resourceGroup": "privatelink", "resourceNavigationLinks": null, "routeTable": null, "serviceAssociationLinks": null, "serviceEndpointPolicies": null, "serviceEndpoints": null }, "type": "Microsoft.Network/networkInterfaces/ipConfigurations", "virtualNetworkTaps": null } ], "location": "eastus2", "macAddress": "", "name": "privatelink.nic.00000000-0000-0000-0000-000000000000", "networkSecurityGroup": null, "primary": null, "privateEndpoint": { "customDnsConfigs": null, "etag": null, "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/privatelink/providers/Microsoft.Network/privateEndpoints/privatelink", "location": null, "manualPrivateLinkServiceConnections": null, "name": null, "networkInterfaces": null, "privateLinkServiceConnections": null, "provisioningState": null, "resourceGroup": "privatelink", "subnet": null, "tags": null, "type": null }, "provisioningState": "Succeeded", "resourceGroup": "privatelink", "resourceGuid": "00000000-0000-0000-0000-000000000000", "tags": null, "tapConfigurations": [], "type": "Microsoft.Network/networkInterfaces", "virtualMachine": null } ` | Enter an optional description for the endpoint. Click Create. 6. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 7. Verify that the private endpoint is available. You can connect to an Atlas cluster using the Azure Private Link private endpoint when all of the resources are configured and the private endpoint becomes available. To verify that the Azure Private Link private endpoint is available: On the Private Endpoint page, select a cluster type and verify the following statuses for the region that contains the cluster you want to connect to using Azure Private Link: | Atlas Endpoint Service Status | Available | | --- | --- | | Endpoint Status | Available | To learn more about possible status values, see [Troubleshoot Private Endpoint Connection Issues.](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) If you do not see these statuses, see [Troubleshoot Private Endpoint Connection Issues](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) for additional information. To set up GCP Private Service Connect in Google Cloud through the Atlas UI: 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Create an endpoint service. In the sidebar, click Private Endpoint. Click Create Endpoint Service. Click the Google Cloud logo to select your cloud provider. From the Atlas Region list, select the region in which you want to create the private endpoint. Click Create Endpoint Service. IMPORTANT: If your organization has no payment information stored, Atlas prompts you to add it before continuing. 3. Add an endpoint to your endpoint service. WARNING: To avoid connection interruptions, you must specify the correct information. We recommend that you don't skip the commands and substeps in this step. Enter the following details about your Google Cloud VPC (Virtual Private Cloud): | Google Cloud Project ID | The unique ID for your project. Find this value on the Dashboard page on your Google Cloud platform. | | --- | --- | | VPC Name | The name of the VPC (Virtual Private Cloud) that you want to use to connect to Atlas. Find this value on the VPC Networks page on your Google Cloud dashboard. | | Subnet Name | The name of the subnet in your Google Cloud VPC (Virtual Private Cloud). Find this value on the VPC Networks page on your Google Cloud dashboard. | | Private Service Connect Endpoint Name | A unique name for your private endpoint. This name is used to identify the endpoint on your Google Cloud platform. | Run the provided Google Cloud command **to reserve an IP address** in your VPC. This single IP address is used by the private endpoint to connect to Atlas. Click Next. Click Create Private Endpoint. Enter the IP address you reserved in your Google Cloud VPC when prompted. Run the provided Google Cloud command to create the required forwarding rule in your VPC. Click Done. 4. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 5. Verify that the private endpoint is available. You can connect to an Atlas cluster using the GCP Private Service Connect private endpoint when all of the resources are configured and the private endpoint becomes available. To verify that the GCP Private Service Connect private endpoint is available: On the Private Endpoint page, verify the following statuses for the region that contains the cluster you want to connect to using GCP Private Service Connect: | Atlas Endpoint Service Status | Available | | --- | --- | | Endpoint Status | Available | To learn more about possible status values, see [Troubleshoot Private Endpoint Connection Issues.](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) If you do not see these statuses, see [Troubleshoot Private Endpoint Connection Issues](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) for additional information. To set up AWS PrivateLink through the Atlas CLI, [install the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/install-atlas-cli/) and [connect from the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli/). Then, complete the following steps: 1. Create the private endpoint service in Atlas. Run the Atlas CLI command to initiate the setup of AWS (Amazon Web Services) PrivateLink in Atlas. Atlas represents these resources in the form of a [private endpoint service](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-private-endpoint-concepts). Ensure that the value of `--region` matches the region where you deployed your cluster: ```sh atlas privateEndpoints aws create [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints aws create.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-aws-create/) If you have a multi-region or multi-cloud cluster and you don't enable [regionalized private endpoints](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-atlas_regionalized-pl), you must provision an endpoint for each provider and region. Note the private endpoint service's ID in the response. In this example, the ID is `6344ac8f51b94c6356527881`. ```json Private endpoint '6344ac8f51b94c6356527881' created. ``` 2. Retrieve the private endpoint service name. IMPORTANT: It might take Atlas some time to provision the private endpoint. Wait 1-2 minutes before you complete this step. Run the Atlas CLI command to describe the [private endpoint](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-private-endpoint-concepts) using its ID: ```sh atlas privateEndpoints aws describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints aws describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-aws-describe/) Note the value for `ENDPOINT SERVICE` in the response, which shows the name of the [private endpoint service](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-private-endpoint-concepts) associated with this [private endpoint](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-private-endpoint-concepts). In this example, the endpoint service name is `com.amazonaws.vpce.us-east-1.vpce-svc-0705499aae25ac77c`: ```json ID ENDPOINT SERVICE STATUS ERROR 6344ac8f51b94c6356527881 com.amazonaws.vpce.us-east-1.vpce-svc-0705499aae25ac77c AVAILABLE ``` If the `STATUS` value is `INITIATING`, wait 1-2 more minutes for Atlas to provision the private endpoint. Then, try this step again. 3. Create the interface endpoint in AWS. Run the command in the AWS (Amazon Web Services) CLI, replacing the following placeholders with your values: | Placeholder | Description | | --- | --- | | {VPC-ID} | Unique string that identifies the peer AWS (Amazon Web Services) VPC (Virtual Private Cloud). Find this value on the VPC (Virtual Private Cloud) dashboard in your AWS (Amazon Web Services) account. | | {REGION} | [AWS region](https://www.mongodb.com/docs/atlas/reference/amazon-aws.md#std-label-amazon-aws) in which your cluster resides. | | {SUBNET-IDS} | Unique string that identifies the subnets that your AWS (Amazon Web Services) VPC (Virtual Private Cloud) uses. Find these values on the Subnet dashboard in your AWS (Amazon Web Services) account. IMPORTANT: You must specify at least one subnet. If you don't, AWS (Amazon Web Services) won't provision an [interface endpoint](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint) in your VPC (Virtual Private Cloud). An interface endpoint is required for clients in your VPC (Virtual Private Cloud) to send traffic to the private endpoint. | | {SERVICE-NAME} | Unique string identifying the private endpoint service that you retrieved previously. | ```sh aws ec2 create-vpc-endpoint --vpc-id {VPC-ID} \ --region {REGION} --service-name {SERVICE-NAME} \ --vpc-endpoint-type Interface --subnet-ids {SUBNET-IDS} ``` To learn more about the AWS (Amazon Web Services) CLI, see [Creating an Interface Endpoint.](http://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#create-interface-endpoint) Note the value in the response for the field `VpcEndpointId`. This is a 22-character alphanumeric string that identifies your private endpoint. You can also find this value on the AWS (Amazon Web Services) VPC Dashboard under Endpoints > VPC ID. 4. Specify the VPC Endpoint ID for your private endpoint. Run the Atlas CLI command to provide the [interface endpoint](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-private-endpoint-concepts) info to Atlas using the Atlas endpoint service ID and the VPC Endpoint ID. In this example, you would set the following parameters: | Parameter | Type | Example Value | | --- | --- | --- | | `endpointServiceId` | Argument | `6344ac8f51b94c6356527881` | | `privateEndpointId` | Option | `vpce-00713b5e644e830a3` | ```sh atlas privateEndpoints aws interfaces create [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints aws interfaces create.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-aws-interfaces-create/) 5. Configure your resources' security groups to send traffic to and receive traffic from the [interface endpoint](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint). For each resource that needs to connect to your Atlas clusters using AWS PrivateLink, the resource's security group must allow outbound traffic to the [interface endpoint's](https://www.mongodb.com/docs/manual/reference/glossary.md#std-term-interface-endpoint) private IP addresses on all ports (1024-65535). See [Adding Rules to a Security Group](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html#adding-security-group-rule) for more information. 6. Create a security group for your interface endpoint to allow resources to access it. This security group must allow inbound traffic on all ports from each resource that needs to connect to your Atlas clusters using AWS PrivateLink: In the AWS (Amazon Web Services) console, navigate to the VPC Dashboard. Click Security Groups, then click Create security group. Use the wizard to create a security group. Make sure you select your VPC from the VPC list. Select the security group you just created, then click the Inbound Rules tab. Click Edit Rules. Add rules to allow all inbound traffic from each resource in your VPC that you want to connect to your Atlas cluster. Click Save Rules. Click Endpoints, then click the endpoint for your VPC. Click the Security Groups tab, then click Edit Security Groups. Add the security group you just created, then click Save. To learn more about [VPC security groups](http://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html), see the AWS (Amazon Web Services) documentation. 7. Verify the private endpoint's availability. You can connect to the cluster using the AWS PrivateLink private endpoint after Atlas finishes configuring all of the resources and the private endpoint becomes available. To verify that the AWS (Amazon Web Services) private endpoint is available: Run the Atlas CLI command to describe the interface endpoint using its ID. In this example, you would set the following parameters: | Parameter | Type | Example Value | | --- | --- | --- | | `interfaceEndpointId` | Argument | `vpce-00713b5e644e830a3` | | `endpointServiceId` | Option | `6344ac8f51b94c6356527881` | ```sh atlas privateEndpoints aws interfaces describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints aws interfaces describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-aws-interfaces-describe/) Verify that the `STATUS` field's value is `AVAILABLE` as shown in the following example: ```json ID STATUS ERROR vpce-00713b5e644e830a3 AVAILABLE ``` To set up Azure Private Link through the Atlas CLI, [install the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/install-atlas-cli/) and [connect from the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli/). Then, complete the following steps: 1. Create the private endpoint service in Atlas. Run the Atlas CLI command to create a private endpoint and private endpoint service in Atlas. Ensure that the value of `--region` matches the region where you deployed your cluster: ```sh atlas privateEndpoints azure create [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints azure create.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-azure-create/) If you have a multi-region or multi-cloud cluster and you don't enable [regionalized private endpoints](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-atlas_regionalized-pl), you must provision an endpoint for each provider and region. Note the private endpoint service's ID in the response. In this example, the ID is `6344ac8f51b94c6356527881`. ```json Private endpoint '6344ac8f51b94c6356527881' created. ``` 2. Retrieve the private endpoint service name. IMPORTANT: It might take Atlas some time to provision the private endpoint. Wait 1-2 minutes before you complete this step. Run the Atlas CLI command to describe the private endpoint using its service ID: ```sh atlas privateEndpoints azure describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints azure describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-azure-describe/) Note the value for `ENDPOINT SERVICE` in the response, which shows the endpoint service name. In this example, the endpoint service name is `pls_6344ac8f51b94c6356527881`: ```json ID ENDPOINT SERVICE STATUS ERROR 6344ac8f51b94c6356527881 pls_6344ac8f51b94c6356527881 AVAILABLE ``` If the `STATUS` value is `INITIATING`, wait 1-2 more minutes for Atlas to provision the private endpoint. Then, try this step again. 3. Create the endpoint in Azure. Run the `az network private-endpoint create` command in the Azure (Microsoft Azure) CLI, replacing the following placeholders with your values: | Placeholder | Description | | --- | --- | | {RESOURCE-GROUP-NAME} | Name of the Azure (Microsoft Azure) resource group that contains the VNet that you want to use to connect to Atlas. You can find this value on the Resource Group Properties page on your Azure (Microsoft Azure) dashboard. | | {VIRTUAL-NETWORK-NAME} | Name of the VNet that you want to use to connect to Atlas. You can find this value on the Virtual Network page on your Azure (Microsoft Azure) dashboard. | | {SUBNET-NAME} | Name of the subnet in your Azure (Microsoft Azure) VNet. You can find this value on the Virtual Network Subnets page on your Azure (Microsoft Azure) dashboard. | | {PRIVATE-ENDPOINT-NAME} | Human-readable label that identifies the private endpoint within your Azure (Microsoft Azure) resource group. | | {SUBSCRIPTION-ID} | Unique string that identifies your subscription in Azure (Microsoft Azure). You can find this value on the Subscriptions page in Azure (Microsoft Azure). | | {RESOURCE-GROUP-ID} | Unique string that identifies your Azure (Microsoft Azure) resource group on Atlas. You can find this value on the Private Endpoint page under the Network Access section in the Atlas UI. This value begins with `rg_` and contains a combination of letters and numbers, that resembles `rg_65c66a56a3a43...`. | | {ENDPOINT-SERVICE-NAME} | Unique string that identifies the endpoint service. This is the endpoint service name returned in a previous step. | ```sh az network private-endpoint create --resource-group {RESOURCE-GROUP-NAME} --name {PRIVATE-ENDPOINT-NAME} --vnet-name {VIRTUAL-NETWORK-NAME} --subnet {SUBNET-NAME} --private-connection-resource-id /subscriptions/{SUBSCRIPTION-ID}/resourceGroups/{RESOURCE-GROUP-ID}/providers/Microsoft.Network/privateLinkServices/{ENDPOINT-SERVICE-NAME} --connection-name {ENDPOINT-SERVICE-NAME} --manual-request true ``` To learn more about the Azure (Microsoft Azure) CLI, see [Create a Private Endpoint by Using the Azure CLI.](https://docs.microsoft.com/en-us/azure/private-link/create-private-endpoint-cli) 4. Specify the Resource ID and Private IP for your private endpoint. Run the Atlas CLI command to create an interface endpoint in Atlas using the Atlas endpoint service ID, the Azure (Microsoft Azure) Resource ID, and the Azure (Microsoft Azure) Private IP. In this example, you would set the following parameters: | Parameter | Type | Example Value | | --- | --- | --- | | `endpointServiceId` | Argument | `6344ac8f51b94c6356527881` | | `privateEndpointId` | Option | `/subscriptions/4e133d35-e734-4385-a565-c0945567ae346/` `resourceGroups/rg_95847a959b876e255dbb9b33_dfragd7w/` `providers/Microsoft.Network/privateEndpoints/` `test-endpoint` | | `privateEndpointIpAddress` | Option | `10.0.0.4` | ```sh atlas privateEndpoints azure interfaces create [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints azure interfaces create.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-azure-interfaces-create/) Note the private endpoint's interface endpoint ID in the response. In this example, the ID is `/subscriptions/` `4e133d35-e734-4385-a565-c0945567ae346/resourceGroups/` `rg_95847a959b876e255dbb9b33_dfragd7w/providers/` `Microsoft.Network/privateEndpoints/cli-test`. ```json Interface endpoint '/subscriptions/4e133d35-e734-4385-a565-c0945567ae346/resourceGroups/rg_95847a959b876e255dbb9b33_dfragd7w/providers/Microsoft.Network/privateEndpoints/cli-test' created. ``` 5. Verify the private endpoint's availability. You can connect to the cluster using the Azure Private Link private endpoint after Atlas finishes configuring all of the resources and the private endpoint becomes available. To verify that the Azure (Microsoft Azure) private endpoint is available: Run the Atlas CLI command to describe the interface endpoint using its ID and the interface endpoint ID you retrieved in the previous step. In this example, you would set the following parameters: | Parameter | Type | Example Value | | --- | --- | --- | | `privateEndpointResourceId` | Argument | `/subscriptions/4e133d35-e734-4385-a565-c0945567ae346/` `resourceGroups/rg_95847a959b876e255dbb9b33_dfragd7w/` `providers/Microsoft.Network/privateEndpoints/cli-test` | | `endpointServiceId` | Option | `6344ac8f51b94c6356527881` | ```sh atlas privateEndpoints azure interfaces describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints azure interfaces describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-azure-interfaces-describe/) Verify that the `STATUS` field's value is `AVAILABLE` as shown in the following example: ```json ID STATUS ERROR pls_6344ac8f51b94c6356527881 AVAILABLE ``` To set up GCP Private Service Connect in Google Cloud through the Atlas CLI, [install the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/stable/install-atlas-cli/) and [connect from the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/stable/connect-atlas-cli/). Then, complete the following steps: 1. Create the private endpoint in Atlas. Run the Atlas CLI command to create a port mapped private endpoint in Atlas. Ensure that the value of `--region` matches the region where you deployed your cluster: ```sh ./atlas privateEndpoints gcp create --region CENTRAL_US --portMappingEnabled ``` **Note:** If you don't explicitly set the `--portMappingEnabled` flag, the private endpoint will be created without port mapping. If you have a multi-region or multi-cloud cluster and you don't enable [regionalized private endpoints](https://www.mongodb.com/docs/atlas/security-private-endpoint.md#std-label-atlas_regionalized-pl), you must provision an endpoint for each provider and region. Note the private endpoint's ID in the response. In this example, the ID is `6344ac8f51b94c6356527881`. ```json Private endpoint '6344ac8f51b94c6356527881' created. ``` 2. Wait for the private endpoint to become available. IMPORTANT: It might take Atlas some time to provision the private endpoint. Wait 1-2 minutes before you complete this step. Run the Atlas CLI command to describe the private endpoint using its ID: ```sh atlas privateEndpoints gcp describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints gcp describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-gcp-describe/) The following shows a sample output: ```json ID GROUP NAME REGION STATUS PORT MAPPING ENABLED ERROR 69948cba1faa593416bbbd7d N/A CENTRAL_US AVAILABLE true ``` If the `STATUS` value is `INITIATING`, wait 1-2 more minutes for Atlas to provision the private endpoint. Then, try this step again. 3. Create the endpoint in GCP. Run the following commands to allocate an IP address and create the private endpoint, replacing the following placeholders with your values: | Placeholder | Description | | --- | --- | | {GCP-PROJECT-ID} | Unique string that identifies your Google Cloud project in Google Cloud. | | {ATLAS-GCP-PROJECT-ID} | Unique string that identifies the Google Cloud project in which Atlas deploys your resources. | | {ENDPOINT} | Unique string that identifies your private endpoint. | | {REGION} | Google Cloud region in which your cluster resides. | | {SUBNET} | When you create Private Service Connect endpoints, you specify a subnet in your VPC network; you may either create a new subnet to encapsulate your endpoints or use an existing one. | | {VPC-NAME} | Name of the VNet that you want to use to connect to Atlas. You can find this value on the VPC Network page on your Google Cloud dashboard. | | {GROUP-ID} | Unique 24-character hexadecimal string that identifies your project in Atlas. | ```sh gcloud config set project {GCP-PROJECT-ID} gcloud compute addresses create {ENDPOINT}-ip --region={REGION} --subnet={SUBNET} gcloud compute forwarding-rules create {ENDPOINT} --region={REGION} --network={VPC-NAME} --address={ENDPOINT}-ip --target-service-attachment=projects/{ATLAS-GCP-PROJECT-ID}/regions/{REGION}/serviceAttachments/sa-{REGION}-{GROUP-ID} ``` 4. Specify the VPC Endpoint ID for your private endpoint. Run the Atlas CLI command to create an interface endpoint in Atlas using the Atlas endpoint ID and the VPC Endpoint ID. In this example, you would set the following parameters: | Parameter | Type | Example Value | | --- | --- | --- | | `endpointGroupId` | Argument | `tester-1` | | `endpointServiceId` | Option | `6344ac8f51b94c6356527881` | | `gcpProjectId` | Option | `atlascli-private-endpoints` | | `endpoint` | Option | `tester-1@10.142.0.1` If Google Cloud PSC port mapping is enabled for the backing private endpoint service, then this parameter should only be of size 1. | To add a new interface for a Google Cloud private endpoint using the Atlas CLI, run the following command: ```sh atlas privateEndpoints gcp interfaces create [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints gcp interfaces create.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-gcp-interfaces-create/) 5. Verify the private endpoint's availability. You can connect to the cluster using the GCP Private Service Connect private endpoint after Atlas finishes configuring all of the resources and the private endpoint becomes available. To verify that the Google Cloud private endpoint is available: Run the Atlas CLI command to describe the interface endpoint using its ID. In this example, you would use the following parameters from the previous step: | Parameter | Type | Example Value | | --- | --- | --- | | `id` | Argument | `tester-1` | | `endpointServiceId` | Option | `6344ac8f51b94c6356527881` | To return the Google Cloud private endpoint interface that you specify. using the Atlas CLI, run the following command: ```sh atlas privateEndpoints gcp interfaces describe [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas privateEndpoints gcp interfaces describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-privateEndpoints-gcp-interfaces-describe/) Verify that the `STATUS` field's value is `AVAILABLE` as shown in the following example: ```json ENDPOINT STATUS DELETE REQUESTED tester-1 AVAILABLE false ``` If the `STATUS` value is `VERIFIED`, wait 1-2 more minutes for Atlas to make your private endpoint available. ## Take the Next Steps - [Manage and Connect from Private Endpoints](https://www.mongodb.com/docs/atlas/security-manage-private-endpoint.md#std-label-manage-private-endpoints) - [Troubleshoot Private Endpoint Connection Issues](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md#std-label-pl-troubleshooting) - [How can I optimize connection performance for sharded clusters using private endpoints?](https://www.mongodb.com/docs/atlas/reference/faq/connection-changes.md#std-label-optimized-connection-strings)