Back to Checks
mongodbatlas

Cluster has authentication enabled

clusters_authentication_enabled
Service: clustersSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

MongoDB Atlas clusters enforce database authentication for client connections (authEnabled).

Identifies clusters where authentication is not required for access.

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Without authentication, anyone with network reach can access the database, compromising confidentiality and integrity. Attackers can exfiltrate data, modify or delete records, and create backdoor users, leading to outages and data loss that impact availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks clusters_authentication_enabled

Recommendation

Enable and enforce database authentication on all clusters.

  • Prefer strong methods (X.509, OIDC, AWS IAM) over static passwords
  • Grant least privilege roles and avoid shared accounts
  • Rotate credentials/keys
  • Combine with IP access lists or private endpoints for defense in depth

Remediation

CLI

atlas dbusers create --username <USERNAME> --password <PASSWORD> --role readWriteAnyDatabase@admin --projectId <PROJECT_ID>

Terraform

# Create a MongoDB Atlas database user to enable authentication
resource "mongodbatlas_database_user" "example_resource_name" {
  project_id         = "<example_resource_id>"
  username           = "<example_resource_name>"
  password           = "<PASSWORD>"
  auth_database_name = "admin"  # Critical: SCRAM user on admin enables DB auth

  roles {                         # Minimal role assignment required to create the user
    role_name     = "readWriteAnyDatabase"
    database_name = "admin"
  }
}

Other

1In the Atlas UI, open your project and go to Security > Database Access
2Click Add New Database User
3Select Username/Password, enter a username and password
4Assign a role (e.g., readWriteAnyDatabase on admin)
5Click Add User to save
6This creates a database user, enabling authentication for the cluster

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.services.clusters.clusters_client import (
    clusters_client,
)


class clusters_authentication_enabled(Check):
    """Check if MongoDB Atlas clusters have authentication enabled

    This class verifies that MongoDB Atlas clusters have authentication
    enabled to prevent unauthorized access to the database.
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas cluster authentication enabled check

        Iterates over all clusters and checks if they have authentication
        enabled (authEnabled=true).

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each cluster
        """
        findings = []

        for cluster in clusters_client.clusters.values():
            report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=cluster)

            if cluster.auth_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Cluster {cluster.name} in project {cluster.project_name} "
                    f"has authentication enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Cluster {cluster.name} in project {cluster.project_name} "
                    f"does not have authentication enabled."
                )

            findings.append(report)

        return findings

References