MongoDB Atlas: About Private Endpoints
This article explains how private endpoints work with MongoDB Atlas in Eon, including when to use one and how source and restore projects differ.
A private endpoint keeps all traffic between Eon and your MongoDB Atlas cluster on the AWS private network, so your database is never exposed to the public internet. On AWS, Atlas implements private endpoints using AWS PrivateLink. A private endpoint is a one-way connection: your virtual private cloud (VPC) connects to the Atlas VPC, but Atlas can’t start a reciprocal connection back into your network.
Private endpoints are one of MongoDB Atlas’s network-access options, alongside IP access lists and VPC peering. By default, Atlas blocks all inbound access. You allow it via an IP access list, VPC peering, or private endpoints. When you add a private endpoint, Atlas adds it to the project’s IP access list automatically, so private endpoint connections don’t need manual IP access list entries.
When to use a private endpoint
Use a private endpoint when your security policy requires that database traffic stays off the public internet. A private endpoint is useful when your Atlas cluster is in the same AWS region as Eon’s scanning infrastructure, and you want to eliminate any reliance on public connectivity.
Private endpoints require a dedicated (M10 or higher) cluster. They aren’t available on Free or Flex clusters.
Private endpoints are also region-specific. The Atlas endpoint service is tied to the cluster’s primary region, and cross-region connectivity requires adding accepted endpoint regions. If the cluster is in a region where a private endpoint isn’t configured, the connection won’t work.
Setting up a private endpoint in MongoDB Atlas requires Project Owner or Organization Owner access.
Source and restore projects
How Eon establishes the private endpoint differs between source projects and restore projects, because the AWS VPC interface endpoint lives in a different place in each case.
Source projects
For a source project, Eon provisions and manages the VPC interface endpoint in Eon’s own scanning account. You don’t create the endpoint yourself. Instead, you supply the Atlas endpoint-service name, and Eon creates the endpoint and returns the VPC Endpoint ID for you to register in Atlas.
Restore projects
For a restore project, the endpoint lives in your AWS restore account, which is the account where Eon’s temporary restore server runs. You create the interface VPC endpoint in that account yourself and provide the existing VPC Endpoint ID to Eon, which then discovers and verifies it.
For instructions on setting up a private endpoint for either project type, see MongoDB Atlas: Configure Private Endpoints.
Additional information
How-to guides:
Related concepts: