Back to Checks
mongodbatlas

Organization requires API operations to originate from an IP address on the API access list

organizations_api_access_list_required
Service: organizationsSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:NotDefined

MongoDB Atlas organizations can require Atlas Administration API requests to originate only from IPs or CIDRs listed in the organization's API access list (apiAccessListRequired).

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Without IP allowlisting, the Atlas Administration API is reachable from any network. A leaked token can be used from arbitrary hosts to:

  • change org/project settings and users
  • create, modify, or delete clusters This undermines integrity and availability and expands the blast radius of credential compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks organizations_api_access_list_required

Recommendation

Require the org API access list and restrict it to trusted, fixed egress IPs/CIDRs. Enforce least privilege on service accounts, prefer short-lived tokens, rotate secrets, and review entries regularly. Pair with MFA/SSO and monitoring for defense in depth.

Remediation

CLI

curl --digest -u "<PUBLIC_KEY>:<PRIVATE_KEY>" -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v2/orgs/<ORG_ID>/settings" -d '{"apiAccessListRequired":true}'

Terraform

resource "mongodbatlas_organization_settings" "<example_resource_name>" {
  org_id = "<example_resource_id>"

  api_access_list_required = true # Critical: Enforces that Atlas Admin API calls must originate from IPs on the org's API access list
}

Other

1In the MongoDB Atlas UI, open the target organization and go to Organization Settings
2Toggle "Require IP Access List for the Atlas Administration API" to On
3Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.services.organizations.organizations_client import (
    organizations_client,
)


class organizations_api_access_list_required(Check):
    """Check if organization requires API access list

    This class verifies that MongoDB Atlas organizations require API operations
    to originate from an IP Address added to the API access list.
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas organization API access list required check

        Iterates over all organizations and checks if they require API operations
        to originate from an IP Address added to the API access list.

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each organization
        """
        findings = []

        for organization in organizations_client.organizations.values():
            report = CheckReportMongoDBAtlas(
                metadata=self.metadata(), resource=organization
            )

            if organization.settings.api_access_list_required:
                report.status = "PASS"
                report.status_extended = (
                    f"Organization {organization.name} requires API operations "
                    f"to originate from an IP Address added to the API access list."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Organization {organization.name} does not require API operations "
                    f"to originate from an IP Address added to the API access list."
                )

            findings.append(report)

        return findings

References