Back to Checks
mongodbatlas

Project has database auditing enabled

projects_auditing_enabled
Service: projectsSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:NotDefined

MongoDB Atlas projects with database auditing capture database operations and administrative events. The evaluation looks for an active audit configuration and, when present, notes any configured audit_filter that scopes which events are recorded.

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Without auditing, critical actions lack traceability, reducing detectability and impeding forensics. Attackers can mask unauthorized reads/writes and privilege changes, threatening data confidentiality and integrity, and weakening non-repudiation and incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks projects_auditing_enabled

Recommendation

Enable auditing and apply least-privilege filters to capture high-risk events:

  • authentication and session activity
  • DDL/config changes
  • user/role modifications and privilege grants

Centralize logs in a SIEM, enforce retention/immutability with separation of duties, restrict access, and tune auditAuthorizationSuccess to balance coverage vs performance.

Remediation

CLI

atlas auditing update --projectId <example_resource_id> --enabled

Terraform

resource "mongodbatlas_auditing" "example" {
  project_id = "<example_resource_id>"
  enabled    = true  # Critical: turns on project-level database auditing to pass the check
}

Other

1Sign in to MongoDB Atlas and open the target project
2In the left sidebar, click Security > Database & Network Access, then click Advanced
3Toggle Database Auditing to On
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.services.projects.projects_client import (
    projects_client,
)


class projects_auditing_enabled(Check):
    """Check if database auditing is enabled for MongoDB Atlas projects

    This class verifies that MongoDB Atlas projects have database auditing
    enabled to track database operations and security events.
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas project auditing enabled check

        Iterates over all projects and checks if they have database auditing
        enabled by examining the audit configuration.

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each project
        """
        findings = []

        for project in projects_client.projects.values():
            report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=project)

            if not project.audit_config:
                report.status = "FAIL"
                report.status_extended = f"Project {project.name} does not have audit configuration available."
            else:
                # Check if audit configuration is enabled
                if project.audit_config.enabled:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Project {project.name} has database auditing enabled."
                    )
                    if project.audit_config.audit_filter:
                        report.status_extended += f" Audit filter configured: {project.audit_config.audit_filter}"
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Project {project.name} does not have database auditing enabled."

            findings.append(report)

        return findings

References