Atlas: set up an AWS PrivateLink private endpoint

Private endpoint (AWS PrivateLink)

Private endpoints work on dedicated clusters (M10+); not on Free or Flex tiers. They beat peering when you cannot coordinate CIDRs.

Steps

1. Atlas UI: Security, Network Access, Private Endpoint, Add Private Endpoint. Choose AWS and the region. Atlas returns a service name and a private endpoint ID.
2. In AWS, create an interface VPC endpoint with that service name in your VPC and subnets.
3. Back in Atlas, approve the endpoint (add your VPC endpoint ID). Wait for the status to become available.
4. Atlas generates private endpoint-aware connection strings. Use the DNS seedlist form (mongodb+srv://cluster0-pl-0.[id].mongodb.net) so DNS follows port changes automatically.
5. Update the app connection string and redeploy.

Rules

• Use the private string from the dialog. The public SRV string still works but defeats the purpose.
• Security groups on the interface endpoint must allow your app subnets on the Atlas ports.
• Each region needs its own endpoint for multi-region clusters.

Verify

Connect from inside the VPC with the private string, then confirm in Atlas that connections arrive via the private endpoint. Remove the public access list entries.

Private endpoint setup (Atlas-side creation, AWS interface endpoint, approval, private endpoint-aware connection strings) per https://www.mongodb.com/docs/atlas/security-private-endpoint/, verified 2026-09-26. Not available on M0 or Flex tiers per the same docs.