Feature Request: Per-Database User IP Allow Lists

Background

We use MongoDB with multiple external integrations that require read-only access to specific collections (e.g. ETL/CDC platforms, reporting tools, and analytics platforms).

Today, MongoDB allows IP allow lists to be configured at the project/network level, but there is no way to restrict which IP addresses can authenticate using a specific database user.

Current Limitation

For example:

• Integration A uses a dedicated read-only database user from a known set of IP addresses.

• Integration B uses a different read-only database user from a different set of IP addresses.

Currently, if both sets of IPs are added to the project’s allow list, either integration can authenticate using either database user, provided they know the credentials.

This means network restrictions cannot be tied to individual service accounts, resulting in a broader trust boundary than we’d like.

Requested Feature

Allow administrators to define allowed source IP addresses (or CIDR ranges) per database user, in addition to the existing project-level allow list.

If we need to restrict a dbuser from one specific ip address only, how we can manage it in atlas ? This one is mandatory thing. As per existing atlas "Network Access", if whitelist an ip address, every database user can access from this ip address. So if we create a new dbuser with new roles, it will not be useful. Is there any work around is there in atlas for this one ? In stand Alone MongoDB Installtion is possible to do , but in atlas is not possible.

My customer also feedback that they hope to be able to specify a Database Access Account on Atlas and limit it to a specific IP range for connecting to Atlas. In their case, everyone can access the database using their system accounts from the company. This could potentially lead to difficulties with permission misuse.

Hi @Andrew Davidson. Perhaps I can offer a scenario where this is useful: I run db on Atlas and server on heroku. I would like to use certificates to securely connect between my mongodb and heroku server. For this connection I want to enable all ip addresses (because limiting these is problematic and expensive). However, to still keep it secure, I ONLY intend to use these certificate on the heroku server, not for any other access. For access from our office (for technical support), I want to use basic authentication by password but ONLY with our static ip address from the office. Now the problem: its not possible to set ip addresses PER database access user.

This feature would be excellent for our company for Privileged Access Management. E.g. Application users are only able to access from our compute clusters, while operational users who need troubleshooting access from on premise can only access from those IP ranges. This would allow us to prevent users from abusing application credentials and vice versa

Can you elaborate more on the use case and why this is important? What are you trying to do that requires this, or is it more of a hypothetical?