Enterprise Security

Introduction

Enterprise security goes beyond TLS and RBAC. Banks, healthcare providers and government tenants demand auditable, certifiable controls: federated identity, encryption with customer-managed keys, immutable audit logs, network isolation, and continuous compliance evidence.

Atlas + MongoDB Enterprise provide every primitive auditors expect (SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, FedRAMP). The job of an engineering team is to enable them correctly and prove it.

Understanding the topic

The enterprise security stack:

• Federated SSO — Okta / Azure AD / Ping for human access; no shared passwords.
• Workload Identity — IAM/OIDC for app auth; no long-lived credentials on disk.
• Customer-managed encryption keys (CMEK / BYOK) — you hold the key, MongoDB cannot decrypt without you.
• Queryable / Field-level encryption — sensitive columns encrypted client-side.
• Private networking — VPC peering, AWS PrivateLink, Azure Private Endpoint — cluster never on public internet.
• Audit logging — every authN, authZ, schema and admin event shipped to SIEM (Splunk, Datadog).
• IP access list + temporary access — short-lived JIT access for support cases.

Informative example

Atlas Database Auditing — capture every DDL + auth event into Splunk:

// Atlas → Project → Auditing → "Custom JSON filter"
{
  "atype": { "$in": ["authenticate", "authCheck", "createUser",
                     "dropDatabase", "createCollection", "dropCollection"] }
}

// Stream destination:  Splunk HEC  /  AWS S3  /  Datadog
// Retain 7+ years for SOX / HIPAA compliance.

Real-world use

A US healthcare unicorn passed HITRUST + HIPAA audits by combining Atlas CMEK on AWS KMS, Queryable Encryption on PHI fields, PrivateLink-only access, Okta federation, and Splunk-streamed audit logs — all enabled without writing custom infrastructure.

Best practices

• Require federated SSO + MFA for every human; no local Atlas users.
• Disable the public IP allowlist in production — PrivateLink/VPC peering only.
• Rotate CMK annually, audit failed authentications weekly.
• Tag every cluster with data_classification and enforce policies via Atlas Resource Policies.

Common mistakes

• One shared "admin" Atlas user across the team — auditor's worst nightmare.
• Leaving the default IP allowlist (0.0.0.0/0) on after the POC ends.
• Storing the KMS key in the same account as the cluster — same compromise = same blast radius.