Description:
We are facing an issue managing project-level IP access lists in MongoDB Atlas when multiple services/profiles share the same IP address.

Scenario:

One Atlas Project.

Service is deployed with different cluster profiles (e.g., integration, testing).

Each profile’s Terraform stack provisions:

An Atlas cluster (mongodbatlasadvancedcluster)

A backup schedule (mongodbatlascloudbackup_schedule)

A project IP access list entry (mongodbatlasprojectipaccesslist) using the same IP address.

Behavior Observed:

Integration profile deployment:

Creates cluster, backup, and adds Gateway IP to the project access list. ✅

Testing profile deployment (same service, different profile):

Creates a second cluster and backup.

Attempts to add the same NAT Gateway IP.

Atlas API accepts it (idempotent) → no duplicate error, but no new entry is created either.

Terraform state for the testing profile still assumes ownership of that IP entry.

Delete testing profile:

Destroys cluster and backup.

Also deletes the NAT Gateway IP from the Atlas project (because state thinks it owns it).

❌ Result: the integration profile’s cluster loses access, since the shared IP entry is gone.

Problem:

mongodbatlasprojectipaccesslist does not support safe handling of shared IPs across multiple Terraform states.

Unlike AWS Security Group rules (which have unique IDs per rule, making deletes safe), Atlas identifies IPs only by the IP address string.

This creates a state ownership conflict: one stack can remove IPs required by another.