HashiCorp Vault manages Atlas database credentials by generating them on demand through Vault’s database secrets engine. Instead of maintaining long-lived passwords, applications or developers receive credentials tied to predefined roles and a limited time-to-live (TTL). When the TTL expires, Vault removes the associated MongoDB user, preventing access from persisting beyond its intended use. section 20.2.2
A Vault-based Atlas access pattern typically involves:
- Define Vault roles that map to required Atlas permissions, such as read, readAnyDatabase, or atlasAdmin. section 20.2.2
- Generate database credentials only when access is needed, rather than distributing permanent credentials. section 20.2.2 section 20.2.3
- Use the TTL to restrict temporary or project-specific access, such as short-lived read-only developer access. section 20.2.2
- Choose Vault alongside other authentication options according to security needs, compliance requirements, and the operational environment. section 20.2.3
Temporary developer access
A team can configure a Vault role granting read-only access to an Atlas database, generate credentials for a developer during an investigation, and rely on the TTL to remove the associated MongoDB user automatically afterward. section 20.2.2
