Back to Checks
mongodbatlas

Project network access list has entries and excludes 0.0.0.0/0, ::/0, 0.0.0.0, and ::

projects_network_access_list_exposed_to_internet
Service: projectsSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

MongoDB Atlas project network access list configuration is evaluated for entries that allow access from anywhere (0.0.0.0/0, ::/0, 0.0.0.0, ::) or for missing access lists, instead of restricting connections to specific IPs or CIDRs.

Prowler logoProwlerprowler-provider-mongodbatlas

Risk

Internet-wide access enables scanning, brute force, and credential stuffing against database endpoints. A successful compromise can cause data exfiltration (confidentiality), unauthorized writes or drops (integrity), and service disruption or lockout (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler mongodbatlas --checks projects_network_access_list_exposed_to_internet

Recommendation

Apply least privilege: permit only required IPs/CIDRs or approved security groups; avoid 0.0.0.0/0 and ::/0. Prefer private connectivity (VPC peering or private endpoints) over public access. Use temporary entries for short-lived admin needs and review lists regularly.

Remediation

Terraform

resource "mongodbatlas_project_ip_access_list" "<example_resource_name>" {
  project_id = "<example_resource_id>"
  cidr_block = "<ALLOWED_CIDR>" # Critical: add a restricted CIDR (not 0.0.0.0/0 or ::/0) to ensure the list isn't empty and not open to the world
}

Other

1In MongoDB Atlas, open your project and go to Security > Database & Network Access > IP Access List
2Delete any entries equal to 0.0.0.0/0, ::/0, 0.0.0.0, or ::
3If the list becomes empty, click Add IP Address and add a specific IP/CIDR or an AWS Security Group (for a peered VPC)
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportMongoDBAtlas
from prowler.providers.mongodbatlas.services.projects.projects_client import (
    projects_client,
)


class projects_network_access_list_exposed_to_internet(Check):
    """Check if MongoDB Atlas project network access list is not open to the world

    This class verifies that MongoDB Atlas projects don't have network access
    entries that allow unrestricted access from the internet (0.0.0.0/0 or ::/0).
    """

    def execute(self) -> List[CheckReportMongoDBAtlas]:
        """Execute the MongoDB Atlas project network access list check

        Iterates over all projects and checks if their network access lists
        contain entries that allow unrestricted access from anywhere.

        Returns:
            List[CheckReportMongoDBAtlas]: A list of reports for each project
        """
        findings = []

        for project in projects_client.projects.values():
            report = CheckReportMongoDBAtlas(metadata=self.metadata(), resource=project)

            if not project.network_access_entries:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} has no network access list entries configured, "
                    f"which may allow unrestricted access."
                )
            else:
                open_entries = []

                for entry in project.network_access_entries:
                    if entry.cidr_block and entry.cidr_block in ["0.0.0.0/0", "::/0"]:
                        open_entries.append(f"CIDR: {entry.cidr_block}")

                    if entry.ip_address and entry.ip_address in ["0.0.0.0", "::"]:
                        open_entries.append(f"IP: {entry.ip_address}")

                if open_entries:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Project {project.name} has network access entries open to the world: "
                        f"{', '.join(open_entries)}. This allows unrestricted access from anywhere on the internet."
                    )
                else:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Project {project.name} has properly configured network access list "
                        f"with {len(project.network_access_entries)} restricted entries."
                    )

            findings.append(report)

        return findings

References