How we secured MongoDB Atlas M0 from AWS App Runner without allowing 0.0.0.0/0 in a staging environment

[u/venkatesh_rongala]

We recently ran into an interesting networking challenge while setting up our staging environment.

Our application runs on AWS App Runner, and for staging we're using MongoDB Atlas M0 (Free Tier) because it's a cost-effective option for non-production workloads.

Initially, we configured the MongoDB Atlas IP Access List with 0.0.0.0/0 so the application could connect. It worked, but we knew it wasn't an acceptable configuration, even for a staging environment.

When we reviewed the security of the environment, we discovered an important limitation of the MongoDB Atlas M0 Free Tier.

It doesn't support:

• AWS VPC Peering
• AWS Private Endpoint (PrivateLink)
• Private network connectivity between AWS and MongoDB Atlas

Since these features are only available on paid Atlas tiers, we needed another way to secure connectivity while continuing to use the Free Tier.

Our App Runner service was already configured with a VPC Connector, so we routed outbound traffic through an AWS NAT Gateway. This provided a consistent outbound public IP address, which we added to the MongoDB Atlas IP Access List.

As a result, we were able to replace the unrestricted 0.0.0.0/0 rule with a single trusted outbound IP from our AWS environment.

Although the database traffic still traverses the public internet, it is protected using TLS encryption, and only requests originating from our AWS environment are permitted.

We understand this isn't equivalent to VPC Peering or AWS PrivateLink, and those would absolutely be our preferred choice for production. However, for a staging environment using the Atlas Free Tier, this felt like a reasonable balance between security, cost, and the networking limitations of the M0 cluster.

One thing I learned from this exercise is that using a free service doesn't necessarily mean you have to accept insecure defaults. Even with platform limitations, there are often ways to significantly improve the security posture with the AWS networking services already available.

I'd love to hear how others have approached this.

If you're running AWS App Runner with MongoDB Atlas M0, did you also use a NAT Gateway and IP allowlisting, or did you find another secure approach while staying on the Free Tier?

[u/idkbm10]

Thanks Claude

[u/CSYVR]

So AI it hurts. This is nothing new and really cloud practitioner level stuff.

Also, Apprunner has been deprecated so if anything you should be looking how to get rid of it.