Configure MongoDB Support Access to Atlas Backend Infrastructure
On this page
As an organization owner, you can set up your Atlas organization so that MongoDB Production Support Employees, including Technical Service Engineers, can only access your production servers with your explicit permission. If an issue that requires MongoDB Support arises and you want to grant 24-hour temporary infrastructure access to MongoDB Support, you can grant access at the clusters level. Granting temporary access doesn't give MongoDB Support access to read your database, only the underlying MongoDB and Atlas Search infrastructure, which should exclude sensitive information. You can also revoke temporary infrastructure access at any time prior to the automatic 24-hour expiration. Additionally, you can view who accessed your database logs or cluster in your Activity Feed.
Important
Blocking infrastructure access from MongoDB Support may increase support issue response and resolution time and negatively impact your cluster's availability.
Block Access at the Organization Level
You must be an organization owner to adjust this setting.
In Atlas, go to the Organization Settings page.
Warning
Navigation Improvements In Progress
We're currently rolling out a new and improved navigation experience. If the following steps don't match your view in the Atlas UI, see the preview documentation.
If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.
Click the Organization Settings icon next to the Organizations menu.
The Organization Settings page displays.
Grant Infrastructure Access to MongoDB Support for 24 hours
If an issue that requires MongoDB Support arises and you want to allow MongoDB support staff limited-time access to a cluster within your organization, you can do so with the following procedure.
To grant limited-time access to MongoDB support staff to a cluster through the Atlas Administration API, see Grant MongoDB employee cluster access for one cluster.
You can specify CLUSTER_INFRASTRUCTURE for the grantType field in the request body schema.
In Atlas, go to the Clusters page for your project.
Warning
Navigation Improvements In Progress
We're currently rolling out a new and improved navigation experience. If the following steps don't match your view in the Atlas UI, see the preview documentation.
If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.
If it's not already displayed, select your desired project from the Projects menu in the navigation bar.
If it's not already displayed, click Clusters in the sidebar.
The Clusters page displays.
Grant Access to MongoDB Support Only for Database Logs
If an issue that requires MongoDB Support arises and you want to allow MongoDB support staff limited-time access only to database logs within your organization, you can do so with the following procedure.
To grant access to MongoDB support staff to database logs through the Atlas Administration API, see Grant MongoDB employee cluster access for one cluster.
You can specify CLUSTER_DATABASE_LOGS for the grantType field in the request body schema.
Block MongoDB Support Access to Atlas Cluster Infrastructure and Logs.
Select the organization that contains your desired project from the Organizations menu in the navigation bar.
Select General Settings from the Settings menu in the navigation bar.
Toggle Block MongoDB Support Access to Atlas Cluster Infrastructure and Logs to
Yes.
Grant Temporary Infrastructure Access to MongoDB Support.
Select your desired project from the Projects menu in the navigation bar.
If the Clusters page is not already displayed, click Database in the sidebar.
Select the ellipsis icon (...) to the right of the cluster.
Select Grant Temporary Infrastructure Access to MongoDB Support.
Select Only database logs.
Click Grant Access.
IMPORTANT: You can grant MongoDB Support staff access only to database logs for 24 hours. Any downloads in progress won't be interrupted if you revoke this access. Database audit logs are not included in this access grant.
Revoke Temporary Infrastructure Access to MongoDB Support
If you want to revoke access to a cluster within your organization that has been granted 24-hour temporary infrastructure access, you can do so with the following procedure.
Important
Temporary infrastructure access that is not revoked will automatically expire at the end of 24 hours. Atlas displays a timer indicating the amount of time left before 24-hour temporary infrastructure access expires.
In Atlas, go to the Clusters page for your project.
Warning
Navigation Improvements In Progress
We're currently rolling out a new and improved navigation experience. If the following steps don't match your view in the Atlas UI, see the preview documentation.
If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar.
If it's not already displayed, select your desired project from the Projects menu in the navigation bar.
If it's not already displayed, click Clusters in the sidebar.
The Clusters page displays.
To revoke 24-hour temporary infrastructure access from MongoDB support staff through the Atlas Administration API, see Revoke granted MongoDB employee cluster access for one cluster.
Access Transparency Employee Identifiers
You can monitor certain actions on your infrastructure with an anonymized Employee Identifier, which you can view in each Activity Feed entry related to accessing your infrastructure.
Each Employee Identifier:
Starts with
mongodb-employeeand ends with a few digits.Is unique for each organization and MongoDB employee.
Lasts for 30 days before Atlas automatically replaces it with a new identifier.
Consists of a unique value that Atlas does not reuse for at least 365 days from the day Atlas creates it.
Note
If you have questions about employee access to your cluster infrastructure or logs, contact MongoDB Support.