Network isolation

As explained in MongoDB 8.0 in Action, Third Edition

Network isolation is the restriction of communication paths so that protected systems are reachable only through permitted network boundaries.

Network isolation restricts communication paths so protected systems remain reachable only through permitted network boundaries. In MongoDB Atlas, it forms part of the continuously enforced security controls and depends on deliberate connectivity configuration. section 20.1 section 20.7

Configure Atlas network isolation with layered boundaries:

• Place the Atlas cluster in a virtual private cloud and control permitted traffic with IP access lists. section 20.7
• Use private endpoints for additional isolation, keeping application-to-Atlas traffic within the cloud provider’s private network rather than traversing the public internet. section 20.7
• Treat isolation as one layer alongside firewalls, authentication, authorization, encryption, intrusion detection, and auditing. section 20.7

Figure 20.1 The shared responsibility model in Atlas divides security and operational tasks among customers, MongoDB, and the underlying cloud providers (AWS, GCP, and Azure). (Image © MongoDB 2024 CC BY-NC-SA 3.0)

Use the shared-responsibility diagram to distinguish customer-configured network connectivity from MongoDB’s ongoing enforcement and cloud-provider infrastructure responsibilities. section 20.1

How MongoDB 8.0 in Action, Third Edition covers it

How deep it goes

Explains VPC placement, IP access lists, and private endpoints as configuration patterns within defense in depth.

Examples

Uses Atlas clusters in VPCs, restricted IP ranges, and private endpoints as concrete isolation configurations.

What you can do after

Operate/configure Atlas connectivity using VPCs, IP access lists, and private endpoints as layered controls.

How it connects

Connects network isolation with virtual private clouds, firewalls, IP access lists, private endpoints, and defense in depth.

liveBookmanning.com

Read MongoDB 8.0 in Action, Third Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Kubernetes in Action, Second EditionNetwork isolation is the restriction of network communication so that a pod can communicate only with explicitly permitted pods.

Compare how 2 books explain network isolation →

Related concepts

• proxyuses · A proxy is an intermediary object or component that represents another object or system and mediates interactions with it.
• network policyconfigured by · A network policy is a set of rules that permits or denies network traffic to and from selected workloads or endpoints.
• isolationkind of · Isolation is the separation of components, processes, resources, or contexts to limit interaction, interference, or the propagation of effects between them.
• namespacecontrasts with · A namespace is a naming context or identifier space in which names are defined and resolved, distinguishing them from names in other contexts.
• defense in depthused by · Defense in depth is a security strategy that combines multiple protective controls so that the failure or compromise of one does not eliminate all protection.
• IP access listuses · An IP access list is a set of network addresses permitted to connect to a protected service or deployment.

This explainer was generated by Manning's knowledge graph from the text of MongoDB 8.0 in Action, Third Edition. The section links point to the parts of the book it draws on.