A private endpoint provides private, one-way access from a connected VPC to an Atlas VPC without sending database traffic across the public internet. Atlas can receive connections from your VPC but cannot initiate connections back, preserving a controlled network boundary. section 20.6.3
Use private endpoints when network isolation and controlled connectivity matter:
- Keep application-to-Atlas traffic inside the cloud provider’s private network, reducing exposure to external threats and potentially lowering latency. section 20.6.3
- Extend access through transitive connections: VPCs peered with the endpoint’s VPC can reach Atlas without creating separate private endpoints. section 20.6.3
- Connect hybrid infrastructure when an on-premises data center reaches the cloud VPC through DirectConnect. section 20.6.3
- Combine private endpoints with IP access lists, authentication, authorization, and encryption as layers of defense in depth. section 20.7
- Check tier constraints before choosing alternatives: network peering is unavailable for M0 and Flex clusters. section 20.6.3
Sensitive-data application
A finance, health-care, or government application can connect to Atlas through a private endpoint, keeping sensitive database traffic within the private network rather than exposing it to the public internet. section 20.6.3
