> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# MongoDB Atlas: Connect Restore Projects

This article explains how to connect a MongoDB Atlas restore project to Eon.
A MongoDB Atlas restore project links a specific MongoDB Atlas project to an existing AWS restore account.

Eon uses the AWS restore account to:

* Store Atlas project API keys in Secrets Manager when you connect.

* Provision the temporary restore server, which operates as a command node to read backup data from the vault and load it into MongoDB.

* Provide the restore node IAM role that you register in MongoDB Atlas as the restore database user.

In the MongoDB Atlas project, you deploy Eon's access (API key, database user, and IP access list).
During restore, Eon creates a new cluster or reuses an existing one with the name you specify.

## Connect a restore project

You'll start this procedure on the

MongoDB Atlas restore projects

restore accounts page by clicking **Connect Restore Account** and selecting **MongoDB Atlas**.

### Before you start

Before you connect your restore project, make sure:

* You have an AWS restore account connected to Eon and in the **Connected** state, with restore permissions version 1.10.4 or later.
  The AWS account is required because MongoDB Atlas is a managed service and needs an AWS control plane for restore operations.
  See [AWS: Connect Restore Accounts] for instructions.

* You have access to the MongoDB Atlas project with permissions to create database users and API keys.

* You understand the permissions Eon needs to restore your data.
  See [MongoDB Atlas: Permissions Deployment Files] for details.

[AWS: Connect Restore Accounts]: /data-protection/cloud-workloads/aws/restore-accounts/aws-connect-restore-accounts

[MongoDB Atlas: Permissions Deployment Files]: /data-protection/cloud-workloads/mongodb-atlas/permissions/mongodb-atlas-permissions-deployment-files

#### Select AWS restore account

Choose the **AWS restore account** to serve as the control plane for MongoDB Atlas restore operations.

The selected account must be in the **Connected** state and have restore permissions version 1.10.4 or later.
Only eligible accounts are shown in the list.

#### Provide Project ID and choose deployment method

1. In the **Project ID** field, paste your MongoDB Atlas Project ID.

2. Choose whether you want to deploy with **Terraform** or **Bash**:

   * **Terraform**: Use the provided Terraform module to install the required configurations.

   * **Bash**: Run the provided bash script to install the required configurations.

The wizard displays the command or module invocation you'll need.

#### Deploy permissions

#### Bash

1. Copy the provided command and run it in a terminal.
   The command downloads and runs a script that creates the necessary database users and API keys.
   You can [review the script] before running it.

2. The script uses MongoDB Atlas OAuth device authorization for authentication.
   Follow the prompts to authenticate.

3. After the script completes, it displays the Eon public key and Eon private key.
   Copy these values.

[review the script]: https\://eon-public-b2b628cc-1d96-4fda-8dae-c3b1ad3ea03b.s3.amazonaws.com/mongo-atlas-eon-setup.sh

#### Terraform

The `mongodbatlas` provider authenticates using a MongoDB Atlas API key.
This procedure covers providing the API credentials to the Terraform module using environment variables.
For other authentication options, see the [MongoDB Atlas provider documentation].

[MongoDB Atlas provider documentation]: https\://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs/guides/provider-configuration#authentication-methods

1. In MongoDB Atlas, create a programmatic API key you can use to run Terraform:

   1. Open your project and go to **Project Settings** → **Access Manager**.

   2. Click **Create Application** → **API Key**.

   3. Assign the **Project Owner** role.

   4. Copy the public key and private key for use in the next step.

      > **Note**
      >
      > This is your installer key.
      > Eon doesn't store it.
      > When you deploy, the module creates a scoped project API key for Eon's ongoing access.

2. Export the installer key as environment variables:

   ```bash
   export MONGODB_ATLAS_PUBLIC_KEY="<your-atlas-public-key>"
   export MONGODB_ATLAS_PRIVATE_KEY="<your-atlas-private-key>"
   ```

3. Copy the Terraform module invocation from the Eon wizard into a `.tf` file (for example, `main.tf`).
   You can [review the module] before running it.

   The generated snippet includes the `module` block and a `provider` block stub.
   Replace `{...}` in the provider stub with `{}`, or use the following if your configuration does not already define the provider:

   ```hcl
   terraform {
     required_providers {
       mongodbatlas = {
         source  = "mongodb/mongodbatlas"
         version = "~> 1.21"
       }
     }
   }

   provider "mongodbatlas" {}
   ```

4. Add `output` blocks that expose the Eon API key the module creates.
   The wizard does not include these blocks, but you need them to retrieve the keys after apply:

   ```hcl
   output "eon_public_key" {
     value       = module.mongo_atlas_restore.eon_public_key
   }

   output "eon_private_key" {
     sensitive   = true
     value       = module.mongo_atlas_restore.eon_private_key
   }
   ```

5. Apply the changes to create the necessary database users and API keys.

6. After Terraform completes, the Eon public key is returned in the output.
   The Eon private key is hidden because it's sensitive, so retrieve it with:

   ```bash
   terraform output -raw eon_private_key
   ```

   Copy both keys for the next step.

[review the module]: https\://eon-public-b2b628cc-1d96-4fda-8dae-c3b1ad3ea03b.s3.amazonaws.com/mongo-atlas-eon-setup.zip

#### Enter Eon keys

Return to the Eon console and paste the **Eon public key** and **Eon private key** from the setup output, and then click **Connect**.

Eon checks that the necessary configurations are in place in the MongoDB Atlas project and, if successful, adds the restore project to the **MongoDB Atlas projects** list.

Eon now has the access it needs in the MongoDB Atlas project, and you can [restore a cluster or selected databases] to clusters in the project.

To keep traffic between Eon and this project on the AWS private network, [configure a private endpoint](#configure-a-private-endpoint).

[restore a cluster or selected databases]: /data-protection/restoring/restore-cloud-workloads/mongodb-atlas/mongodb/mongodb-restore-a-cluster

## Configure a private endpoint

You can configure an AWS private endpoint so traffic between Eon and this Atlas project stays on the AWS private network.
For a restore project, the AWS VPC interface endpoint lives in your own AWS restore account (the account where Eon's temporary restore server runs).
You create the VPC endpoint yourself and then provide its ID to Eon.
For background, see [MongoDB Atlas: About Private Endpoints].

[MongoDB Atlas: About Private Endpoints]: /data-protection/cloud-workloads/mongodb-atlas/private-endpoints/about-mongodb-atlas-private-endpoints

Before you start, make sure:

* Your Atlas cluster is a dedicated cluster (M10 or higher).
  Private endpoints aren't available on Free or Flex clusters.

* You have Project Owner or Organization Owner access in the MongoDB Atlas project.

* Your cluster is in an AWS region where you plan to configure the private endpoint.
  Private endpoints are region-specific.

#### Create the endpoint service in MongoDB Atlas

1. In the MongoDB Atlas console, go to the **Database & Network Access** page, then click **Private Endpoint** in the sidebar.

2. Select the **Dedicated Cluster** tab and click **Create Endpoint Service**.

3. Choose **AWS** as the cloud provider, select the **Atlas Region** that matches your cluster, and click **Create Endpoint Service**.

4. Copy the **Service Name** displayed for the endpoint service.
   You'll use it in the next step.

#### Create the VPC endpoint in your AWS restore account

In your AWS restore account, create an interface VPC endpoint that targets the Atlas endpoint service name you copied.
When the endpoint is created, copy its **VPC Endpoint ID** (begins with `vpce-`).

#### Register the endpoint with Eon and Atlas

1. In the Eon console, navigate to the restore project and open the private endpoint configuration.
   Enter the **VPC Endpoint ID** you copied from AWS.

2. In the MongoDB Atlas console, return to the **Database & Network Access** page, open your endpoint service, click **Add Endpoint**, and select **Connect Existing Endpoint**.

3. Enter the **VPC Endpoint ID**, click **Submit Endpoint**, and wait for Atlas to show **Available**.

4. In Eon, verify the connection.

Once verification succeeds, all Eon restore traffic to the Atlas project flows over AWS PrivateLink on the private network.

## See also

* [MongoDB Atlas: Restore a Cluster]
* [MongoDB Atlas: Configure Private Endpoints]
* [About Restore Accounts]
* [AWS: Connect Restore Accounts]
* [MongoDB Atlas: Permissions Deployment Files]
* [Manage Restore Accounts]

[MongoDB Atlas: Configure Private Endpoints]: /data-protection/cloud-workloads/mongodb-atlas/private-endpoints/mongodb-atlas-configure-private-endpoints

[MongoDB Atlas: Restore a Cluster]: /data-protection/restoring/restore-cloud-workloads/mongodb-atlas/mongodb/mongodb-restore-a-cluster

[About Restore Accounts]: /data-protection/restoring/restore-accounts/about-restore-accounts

[Manage Restore Accounts]: /data-protection/restoring/restore-accounts/manage-restore-accounts