Back to Checks
mongodbatlas

Cluster has TLS authentication enabled

clusters_tls_enabled
Service: clustersSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:NotDefined

MongoDB Atlas clusters require TLS/SSL for client connections to encrypt data in transit (sslEnabled=true).

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Without enforced TLS, traffic can be intercepted or altered, degrading confidentiality and integrity.

Attackers can run man-in-the-middle attacks, steal credentials or session tokens, and inject/replay queries, leading to unauthorized data access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks clusters_tls_enabled

Recommendation

Enforce TLS 1.2+ for all connections and keep it mandatory (sslEnabled=true).

Apply zero trust and defense in depth: use CA-signed certificates, disable tlsInsecure and similar bypasses, rotate certificates, and restrict access via private networking or trusted IP ranges.

Remediation

CLI

curl -u "<PUBLIC_KEY>:<PRIVATE_KEY>" --digest -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v1.5/groups/<PROJECT_ID>/clusters/<CLUSTER_NAME>" --data '{"sslEnabled": true}'

Other

1Sign in to MongoDB Atlas and open the target project
2Go to Project Settings > Security
3Set Minimum TLS Protocol Version to TLS 1.2 (or higher)
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.services.clusters.clusters_client import (
    clusters_client,
)


class clusters_tls_enabled(Check):
    """Check if MongoDB Atlas clusters have TLS authentication required

    This class verifies that MongoDB Atlas clusters have TLS authentication
    required to secure data in transit.
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas cluster TLS enabled check

        Iterates over all clusters and checks if they have TLS
        enabled (sslEnabled=true).

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each cluster
        """
        findings = []

        for cluster in clusters_client.clusters.values():
            report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=cluster)

            if cluster.ssl_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Cluster {cluster.name} in project {cluster.project_name} "
                    f"has TLS authentication enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Cluster {cluster.name} in project {cluster.project_name} "
                    f"does not have TLS authentication enabled."
                )

            findings.append(report)

        return findings

References