> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# MongoDB Atlas: About Private Endpoints

This article explains how private endpoints work with MongoDB Atlas in Eon,
including when to use one and how source and restore projects differ.

A **private endpoint** keeps all traffic between Eon and your MongoDB Atlas cluster on the AWS private network,
so your database is never exposed to the public internet.
On AWS, Atlas implements private endpoints using AWS PrivateLink.
A private endpoint is a one-way connection: your virtual private cloud (VPC) connects to the Atlas VPC,
but Atlas can't start a reciprocal connection back into your network.

Private endpoints are one of MongoDB Atlas's network-access options,
alongside IP access lists and VPC peering.
By default, Atlas blocks all inbound access.
You allow it via an IP access list, VPC peering, or private endpoints.
When you add a private endpoint,
Atlas adds it to the project's IP access list automatically,
so private endpoint connections don't need manual IP access list entries.

## When to use a private endpoint

Use a private endpoint when your security policy requires that database traffic stays off the public internet.
A private endpoint is useful when your Atlas cluster is in the same AWS region as Eon's scanning infrastructure,
and you want to eliminate any reliance on public connectivity.

Private endpoints require a dedicated (M10 or higher) cluster.
They aren't available on Free or Flex clusters.

Private endpoints are also region-specific.
The Atlas endpoint service is tied to the cluster's primary region,
and cross-region connectivity requires adding accepted endpoint regions.
If the cluster is in a region where a private endpoint isn't configured, the connection won't work.

Setting up a private endpoint in MongoDB Atlas requires Project Owner or Organization Owner access.

## Source and restore projects

How Eon establishes the private endpoint differs between source projects and restore projects,
because the AWS VPC interface endpoint lives in a different place in each case.

### Source projects

For a source project, Eon provisions and manages the VPC interface endpoint in Eon's own scanning account.
You don't create the endpoint yourself.
Instead, you supply the Atlas endpoint-service name,
and Eon creates the endpoint and returns the VPC Endpoint ID for you to register in Atlas.

### Restore projects

For a restore project, the endpoint lives in your AWS restore account,
which is the account where Eon's temporary restore server runs.
You create the interface VPC endpoint in that account yourself
and provide the existing VPC Endpoint ID to Eon,
which then discovers and verifies it.

For instructions on setting up a private endpoint for either project type,
see [MongoDB Atlas: Configure Private Endpoints].

## Additional information

How-to guides:

* [MongoDB Atlas: Configure Private Endpoints]

Related concepts:

* [About Restore Accounts]
* [MongoDB Atlas: MongoDB Support]

[MongoDB Atlas: Configure Private Endpoints]: /data-protection/cloud-workloads/mongodb-atlas/private-endpoints/mongodb-atlas-configure-private-endpoints

[About Restore Accounts]: /data-protection/restoring/restore-accounts/about-restore-accounts

[MongoDB Atlas: MongoDB Support]: /data-protection/cloud-workloads/mongodb-atlas/resources/mongodb