**TL;DR:** Private endpoints give you private connectivity without peering CIDR juggling. Create in Atlas, create the interface endpoint in AWS, approve, then switch strings. Use the DNS seedlist form (mongodb+srv://cluster0-pl-0.[id].mongodb.net) so DNS follows port changes automatically. Update the app connection string and redeploy.

## The fix

1. Atlas UI: Security, Network Access, Private Endpoint, Add Private Endpoint. Choose AWS and the region. Atlas returns a service name and a private endpoint ID.

2. In AWS, create an interface VPC endpoint with that service name in your VPC and subnets.

3. Back in Atlas, approve the endpoint (add your VPC endpoint ID). Wait for the status to become available.

4. Atlas generates private endpoint-aware connection strings. Use the DNS seedlist form (`mongodb+srv://cluster0-pl-0.[id].mongodb.net`) so DNS follows port changes automatically.

5. Update the app connection string and redeploy.

6. Use the private string from the dialog. The public SRV string still works but defeats the purpose.

7. Security groups on the interface endpoint must allow your app subnets on the Atlas ports.

8. Each region needs its own endpoint for multi-region clusters.

## When to use this

- This covers exactly what the title says: Atlas.
- You are setting this up for the first time, or auditing an existing setup.
- You want the key gotchas in one place before you start.

## When not to use this

- You are doing a different workflow with Atlas; these steps are specific to the title above.
- You need the full reference docs; this is the short path, not the manual.

## Compatibility

- Not pinned to a specific version; follows current Atlas behavior.