ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 20:42:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(mongodbatlas): refactor getting started and auth (#8776)

Browse Source
This commit is contained in:
Andoni Alonso
2025-09-29 11:58:09 +02:00
committed by GitHub
parent b57788c7b9
commit 2c96df05f4
2 changed files with 49 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tutorials/mongodbatlas/authentication.md
+33 -28
View File
@@ -2,44 +2,49 @@
MongoDB Atlas provider uses [HTTP Digest Authentication with API key pairs consisting of a public key and private key](https://www.mongodb.com/docs/atlas/configure-api-access/#grant-programmatic-access-to-service).
## Authentication Methods
### Command-Line Arguments
## Required Permissions
```bash
prowler mongodbatlas --atlas-public-key <public_key> --atlas-private-key <private_key>
```
MongoDB Atlas API keys require appropriate permissions to perform security checks:
### Environment Variables
- **Organization Read Only**: Provides read-only access to everything in the organization, including all projects in the organization.
- To [audit the Auditing configuration for the project](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/group/endpoint-auditing), **Organization Owner** permission is required.
```bash
export ATLAS_PUBLIC_KEY=<public_key>
export ATLAS_PRIVATE_KEY=<private_key>
prowler mongodbatlas
```
The IP address where Prowler runs must be added to the IP Access List of the MongoDB Atlas organization API key. To skip this step and use the API key across all IP address types, uncheck the "Require IP Access List for the Atlas Administration API" button in Organization Settings. This setting is [enabled by default](https://www.mongodb.com/docs/atlas/configure-api-access/#optional--require-an-ip-access-list-for-the-atlas-administration-api).
## Creating API Keys
???+ warning
To ensure the check `organizations_api_access_list_required` passes, enable the API access list for the organization and add the execution IP to the organization's IP Access List. When running checks from Prowler Cloud, add our IP to the IP Access List.
### Step-by-Step Guide
![Organization Settings](img/ip-access-list.png)
1. **Log into MongoDB Atlas**
- Access the MongoDB Atlas console
2. **Navigate to Access Manager**
- Go to the organization or project access management section
## API Key
3. **Select API Keys Tab**
- Click on the "API Keys" tab
1. **Log into MongoDB Atlas**: Access the MongoDB Atlas console
2. **Navigate to Access Manager**: Go to the organization access management section:
4. **Create API Key**
- Click "Create API Key"
- Provide a description for the key
- Click "Access Manager" and "Organization Access":
5. **Set Permissions**
- Grant minimum required permissions
![Organization Access](./img/organization-access.png)
6. **Save Credentials**
- Note the public key and private key
- Store credentials securely
- Then click the "Applications" tab inside the Access Manager:
For more details about MongoDB Atlas, see the [MongoDB Atlas Tutorial](./getting-started-mongodbatlas.md).
![Project Access](./img/access-manager.png)
3. **Select API Keys Tab**: Click the "API Keys" tab that appears in the image above
4. **Create API Key**: Click "Create API Key" and provide a description
![Create API Key](./img/create-api-key.png)
5. **Set Permissions**: Recommend project permissions for enhanced security; modify them after creating the key
![Set Permissions](./img/modify-permission.png)
6. **Save Credentials**: Record both the public and private keys, then store them securely
![Save Credentials](./img/copy-key.png)
7. **Add IP Access List**: Add the IP address where Prowler runs to the API Key's IP Access List. To skip this step and use the API key for all IP addresses, uncheck the "Require IP Access List for the Atlas Administration API" button in [Organization Settings](#required-permissions), though this is not recommended.
![Organization Settings](./img/add-ip.png)
docs/tutorials/mongodbatlas/getting-started-mongodbatlas.md
+16 -52
View File
@@ -1,64 +1,42 @@
# Getting Started with MongoDB Atlas
MongoDB Atlas provider enables security assessments of MongoDB Atlas cloud database deployments.
## Prowler CLI
## Features
### Authentication Methods
- **Authentication**: Supports MongoDB Atlas API key authentication
- **Services**: Projects and clusters services
- **Checks**: Network access security and encryption at rest validation
#### Command-Line Arguments
## Creating API Keys
To create MongoDB Atlas API keys:
```bash
prowler mongodbatlas --atlas-public-key <public_key> --atlas-private-key <private_key>
```
1. **Log into MongoDB Atlas**: Access the MongoDB Atlas console
2. **Navigate to Access Manager**: Go to the organization access management section:
#### Environment Variables
- Click on Access Manager and Organization Access:
```bash
export ATLAS_PUBLIC_KEY=<public_key>
export ATLAS_PRIVATE_KEY=<private_key>
prowler mongodbatlas
```
![Organization Access](./img/organization-access.png)
- After that click on the Applications tab inside the Access Manager:
![Project Access](./img/access-manager.png)
3. **Select API Keys Tab**: Click on the "API Keys" tab that appears in the image above
4. **Create API Key**: Click "Create API Key" and provide a description
![Create API Key](./img/create-api-key.png)
5. **Set Permissions**: Project permissions are recommended for security, you can modify them after creating the key
![Set Permissions](./img/modify-permission.png)
6. **Save Credentials**: Note the public key and private key and store them securely
![Save Credentials](./img/copy-key.png)
7. **Add IP Access List**: Add the IP where you are running Prowler to the IP Access List of the API Key. If you want to skip this step and use your API key in all type of IP addresses you need to uncheck the `Require IP Access List for the Atlas Administration API` button on the [Organization Settings](#needed-permissions), but this is not recommended.
![Organization Settings](./img/add-ip.png)
## Basic Usage
### Scan All Projects and Clusters
After storing your API keys, you can run Prowler with the following command:
After storing API keys, run Prowler with the following command:
```bash
prowler mongodbatlas --atlas-public-key <key> --atlas-private-key <secret>
```
Also, you can set your API keys as environment variables:
Alternatively, set API keys as environment variables:
```bash
export ATLAS_PUBLIC_KEY=<key>
export ATLAS_PRIVATE_KEY=<secret>
```
And then just run Prowler with the following command:
Then run Prowler with the following command:
```bash
prowler mongodbatlas
@@ -66,22 +44,8 @@ prowler mongodbatlas
### Scanning a Specific Project
If you want to scan a specific project, you can use the following argument added to the command above:
To scan a specific project, add the following argument to the command above:
```bash
prowler mongodbatlas --atlas-project-id <project-id>
```
### Needed Permissions
MongoDB Atlas API keys require appropriate permissions to perform security checks:
- **Organization Read Only**: Provides read-only access to everything in the organization, including all projects in the organization.
- If you want to be able to [audit the Auditing configuration for the project](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/group/endpoint-auditing), **Organization Owner** is needed.
Also, it's important to note that the IP where you are running Prowler must be added to the IP Access List of the MongoDB Atlas organization API key. If you want to skip this step and use your API key in all type of IP addresses you need to uncheck the `Require IP Access List for the Atlas Administration API` button on the Organization Settings, that setting is [enabled by default](https://www.mongodb.com/docs/atlas/configure-api-access/#optional--require-an-ip-access-list-for-the-atlas-administration-api).
???+ warning
If you want the check `organizations_api_access_list_required` to pass you will need to enable the API access list for the organization, so to make sure that your API Key is working you need to add your IP to the IP Access List of the organization. If you are running the check from Prowler Cloud, you will need to add our IP to the IP Access List.
![Organization Settings](./img/ip-access-list.png)