> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Configure IP Access List Entries **Note:** This page applies to both Atlas Infinite and Atlas Core. Atlas only allows client connections to the cluster from entries in the project's IP access list. Each entry is either a single IP address or a CIDR (Classless Inter-Domain Routing)-notated range of addresses. For AWS (Amazon Web Services) clusters with one or more [VPC Peering](https://www.mongodb.com/docs/atlas/security-vpc-peering.md#std-label-vpc-peering) connections to the same AWS (Amazon Web Services) region, you can specify a Security Group associated with a peered VPC (Virtual Private Cloud). ## Find Your Public IP Address Before you add an entry to the IP access list, you must know the public IP address that you want to grant access to. Use an IP lookup tool, such as [whatismyipaddress.com](https://whatismyipaddress.com/), to find the public IP address of the network you're connecting from. If you connect from a virtual machine hosted on a cloud provider instead of your own network, use that provider's console to find the address: | Cloud Provider | Where to Find It | | --- | --- | | AWS (Amazon Web Services) | In the AWS (Amazon Web Services) EC2 console, select your instance, then check the Networking tab for the Public IPv4 address. | | Google Cloud | In the Google Cloud console, go to the VM instances page. The External IP column shows the instance's public IP address. | | Azure (Microsoft Azure) | In the Azure (Microsoft Azure) portal, select your virtual machine, click Networking, then check the IP configuration for the network interface. | **Note:** Public IP addresses for home and office networks can change over time. If you lose access to your cluster unexpectedly, verify that your current public IP address still matches an entry in the IP access list. ### CIDR Notation CIDR (Classless Inter-Domain Routing) notation writes a range of IP addresses as a base address followed by a slash and a number, such as `192.168.1.0/24`. The number specifies how many bits of the address are fixed as the network part, which determines how many addresses the range covers: | Notation | Addresses Covered | Example Use | | --- | --- | --- | | `/32` | 1 address | A single IP address, such as one client machine. | | `/24` | 256 addresses | A small office or home network. | | `/16` | 65,536 addresses | A large network block. | ## Manage IP Access List Entries **Note:** The MongoDB Atlas Shared Responsibility Model defines the complementary duties of MongoDB and its customers in maintaining a secure and resilient data environment. Under this framework, MongoDB manages the security and operational integrity of the underlying platform, while customers are responsible for the configuration, management, and data policies of their specific deployments. For a detailed breakdown of ownership across security and operational excellence, see [Shared Responsibility Model.](https://www.mongodb.com/resources/products/fundamentals/shared-responsibility) For Atlas clusters deployed on [Google Cloud](https://www.mongodb.com/docs/atlas/reference/google-gcp.md#std-label-google-gcp) or [Microsoft Azure](https://www.mongodb.com/docs/atlas/reference/microsoft-azure.md#std-label-microsoft-azure), add the IP addresses of your Google Cloud or Azure (Microsoft Azure) services to Atlas project IP access list to grant those services access to the cluster. The IP access list applies to all clusters in the project and can have up to 200 IP access list entries, with the following exception: projects with an existing sharded cluster created *before* August 25, 2017 can have up to 100 IP access list entries. Atlas supports creating temporary IP access list entries that expire within a user-configurable 7-day period. **Note:** To restrict access to MongoDB Atlas UI for specific IP addresses, configure the UI IP Access List for your Atlas organization. Although a standard IP Access List can't block access to the Atlas UI, the UI IP Access List lets you restrict access to your Atlas organization's management interface to only the trusted IP addresses or CIDR (Classless Inter-Domain Routing) ranges you specify. You can also restrict sign-in to Atlas UI through your IdP (Identity Provider) authentication policies by using Atlas federated authentication. When you create, delete, or change temporary and non-temporary IP access list entries, Atlas notifies you of these events in the project's Activity Feed. For example, if you modify the address of an IP access list entry, the Activity Feed reports the deletion of the old entry and the creation of the new entry. ### View Activity Feed To view the project's Activity Feed: 1. In Atlas, go to the Project Settings page. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click the icon next to Project Overview. The [Project Settings](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsettings%2FgroupSettings) page displays. 2. In Atlas, go to the Project Activity Feed page. If it's not already displayed, select the organization that contains your desired project from the Organizations menu in the navigation bar. If it's not already displayed, select your desired project from the Projects menu in the navigation bar. In the sidebar, click Activity Feed under the Security header. The [Project Activity Feed](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Factivity) page displays. See also [View All Activity.](https://www.mongodb.com/docs/atlas/alert-resolutions.md#std-label-project-activity-feed) **Note: Activity Feed Considerations** - Atlas does not report updates to an IP access list entry's comment in the Activity Feed. - When you modify the address of an IP access list entry, the Activity Feed reports two new activities: one for the deletion of the old entry and one for the creation of the new entry. ### Required Access To manage IP Access List entries, you must have [`Project Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Owner) or [`Project Network Access Manager`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Project-Network-Access-Manager) access to the project. Users with [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) access must add themselves to the project as a `Project Owner`. Select your interface to view the appropriate procedures. ### View IP Access List Entries To list IP access list entries for your project using the Atlas CLI, run the following command: ```sh atlas accessLists list [options] ``` To return the details for the IP access list entry you specify using the Atlas CLI, run the following command: ```sh atlas accessLists describe [options] ``` To learn more about the syntax and parameters for the previous commands, see the Atlas CLI documentation for [atlas accessLists list](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-accessLists-list/) and [atlas accessLists describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-accessLists-describe/) **See also: Related Links** - [Install the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/install-atlas-cli/) - [Connect to the Atlas CLI](https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli/) You can use the Atlas Administration API to [list existing IP access list entries.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listprojectipaccesslists) 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Click IP Access List in the left navigation, under the Network Access heading. | IP Address | IP address or CIDR (Classless Inter-Domain Routing) block. If this cluster is hosted on AWS (Amazon Web Services), you can provide an AWS (Amazon Web Services) Security Group ID as well. | | --- | --- | | Comment | Description or other information about the access list entry. | | Status | Status of the IP access list entry: **Inactive**: Atlas is not using the IP access list entry. No cloud provider containers are provisioned for the project.; **Pending**: Atlas is configuring the IP access list entry for the project.; **Active**: Atlas has configured the IP access list entry for every container provisioned in the project.; **Active in regions**: Atlas has configured the IP access list entry for every container provisioned in the project for the regions listed, but not any other containers that exist for the project. This applies to AWS (Amazon Web Services) security groups only.; **Failed**: Atlas could not configure the IP access list entry for every container provisioned for the project. | | Actions | Options to [Edit](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-modify-ip-access-list-entry-ui) or [Delete.](https://www.mongodb.com/docs/atlas/security/ip-access-list.md#std-label-delete-ip-access-list-entry-ui) | You can use the [mongodbatlas\_project\_ip\_access\_list](https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/data-sources/project_ip_access_list) data source to view existing IP access list entries. ### Add IP Access List Entries To create an IP access list for your project using the Atlas CLI, run the following command: ```sh atlas accessLists create [entry] [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas accessLists create.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-accessLists-create/) You can use the Atlas Administration API to [add existing IP access list entries.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-createprojectipaccesslist) 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Go to IP Access List. If it isn't already displayed, click IP Access List in the left navigation, under the Network Access heading. Click Add IP Address. 3. Enter an IP address, CIDR (Classless Inter-Domain Routing) block, or Security Group ID. **Important:** Ensure that you add the IP address you will use to access MongoDB as the `admin` user. Enter the desired IP address or CIDR (Classless Inter-Domain Routing)-notated range of addresses: | Entry | Grants | | --- | --- | | An IP address | Access from that address. | | A CIDR (Classless Inter-Domain Routing)-notated range of IP addresses | Access from the designated range of addresses. For peer VPC (Virtual Private Cloud) connections, you can specify the CIDR (Classless Inter-Domain Routing) block (or a subset) or the associated Security Group. The Internet provides online tools for converting a range of IP addresses to CIDR (Classless Inter-Domain Routing), such as [http://www.ipaddressguide.com/cidr](http://www.ipaddressguide.com/cidr). | | Security Group ID (AWS Only) | Access via Security Group membership from a peered VPC. IMPORTANT: Atlas does not support adding AWS (Amazon Web Services) security groups to IP access lists in projects with VPC (Virtual Private Cloud) peering connections in multiple regions. | If you add to a project access list any IPv4 `/0` CIDR, such as `0.0.0.0/0` or `10.0.0.0/0`, Atlas sends an alert email to all users directly granted a role to the project, or indirectly granted a role through team membership (if the team is granted a role to the project). **Warning:** Adding the `/0` CIDR (Classless Inter-Domain Routing), such as `0.0.0.0/0`, allows access from anywhere. This configuration can expose your deployment to unauthorized access, data exfiltration, and other malicious activity. Restrict access to trusted IP addresses or CIDR (Classless Inter-Domain Routing) ranges whenever possible, and use strong credentials for all database users when allowing access from the public Internet. 4. (Optional) Add a comment. In the Comment field, optionally enter a description of the access list entry. 5. (Optional) Set the IP access list as temporary. Check the Save as temporary access list option to specify a length of time that the IP address will be added. After this time, Atlas removes the address from the IP access list. You can select one of the following time periods for the address to be added: - 6 hours - 1 day - 1 week In the IP Access List view, temporary access list entries display the time remaining until the address will expire. Once the IP address expires and is deleted, any client or application attempting to connect to the cluster from the address can't access the cluster. **Note:** You cannot set AWS (Amazon Web Services) security groups as temporary access list entries. 6. Click Confirm. You can use the [mongodbatlas\_project\_ip\_access\_list](https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/resources/project_ip_access_list) resource to add IP access list entries. ### Modify IP Access List Entries You can't modify IP access list entries with the Atlas CLI. Select a different interface to learn how to modify IP access list entries. You can use the Atlas Administration API to [modify existing IP access list entries.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-createprojectipaccesslist) 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Go to IP Access List. If it isn't already displayed, click IP Access List in the left navigation, under the Network Access heading. 3. Edit the target IP access list entry Click Edit for the entry you want to modify. You can modify the IP address or CIDR (Classless Inter-Domain Routing) block of the entry and the comment associated with the entry. If the entry is temporarily added, Atlas displays the remaining time until it will remove the entry and a dropdown to modify the duration of the IP access list entry or convert it to a permanent entry. **Note:** You can't change a permanent IP access list entry to be temporary. 4. Click Confirm to save the changes. To modify an IP access list entry, update the corresponding [mongodbatlas\_project\_ip\_access\_list](https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/resources/project_ip_access_list) resource block in your configuration, then apply the change. ### Delete IP Access List Entries **Important:** When you remove an entry from the IP access list, existing connections from the removed addresses may remain open for a variable amount of time. How much time passes before Atlas closes the connection depends on several factors, including: - how the connection was established - how the application or [driver](https://www.mongodb.com/docs/drivers/) using the address behaves - which protocol (like TCP (Transmission Control Protocol) or UDP (User Datagram Protocol)) the connection uses To delete an IP access list from your project using the Atlas CLI, run the following command: ```sh atlas accessLists delete [options] ``` To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas accessLists delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-accessLists-delete/) You can use the Atlas Administration API to [delete existing users.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-deleteprojectipaccesslist) 1. In Atlas, go to the Database & Network Access page for your project. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar. If it's not already displayed, select your project from the Projects menu in the navigation bar. In the sidebar, click Database & Network Access under the Security heading. The [Database & Network Access](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%2F%3Cproject%3E%23%2Fsecurity%2Fnetwork%2FaccessList) page displays. 2. Go to IP Access List. If it isn't already displayed, click IP Access List in the left navigation, under the Network Access heading. 3. Click Delete for the desired entry. 4. Click Delete again to confirm. To delete an IP access list entry, remove the corresponding [mongodbatlas\_project\_ip\_access\_list](https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/resources/project_ip_access_list) resource block from your configuration, then apply the change.