MongoDB Atlas Admin Associate cheat sheet

Atlas tier families: M0 is free with 512 MB storage; M2 and M5 are shared; M10 and higher are dedicated clusters with isolated compute and storage.

Dedicated clusters are required for features including continuous cloud backup, private endpoints, and auditing; shared-tier clusters do not offer those capabilities.

The default replica set has three data-bearing nodes: one primary and two secondaries; Atlas places them across three availability zones when the selected region supports three zones.

Multi-region clusters can add electable nodes in additional regions; read-only and analytics nodes serve reads but do not vote in elections.

Storage autoscaling raises disk capacity when usage crosses the configured threshold; compute autoscaling changes the cluster tier within configured minimum and maximum tiers.

A cluster tier change performs a rolling restart; the primary steps down and drivers that use retryable writes reconnect through DNS SRV discovery.

Cluster names must be unique within an Atlas project; the project ID scopes API paths, users, alerts, and backups.

Database authentication supports SCRAM-SHA-256, SCRAM-SHA-1, X.509, LDAP, and AWS IAM; Atlas UI login supports SAML or OIDC federation.

Database users are project-scoped; built-in roles include read, readWrite, dbAdmin, clusterMonitor, and root, while custom roles define privileges by resource and action.

Organization API keys can manage multiple projects; project API keys are limited to one project; both use HTTP Digest authentication with a public and private key.

Atlas encrypts data at rest with cloud provider KMS; TLS encrypts client and intra-cluster connections; customer-managed keys are supported on dedicated clusters.

Audit logging records authentication and authorization events and is available on dedicated clusters; it is configured at the project level.

The organization owner can enforce two-factor authentication for Atlas users; project roles control access to clusters, backups, and alerts within a project.

X.509 database users authenticate with client certificates signed by a CA; the certificate subject maps to the Atlas database user name.

IP access list entries accept single IP addresses or CIDR blocks; a project must have at least one entry before clients can connect through public endpoints.

VPC peering requires non-overlapping CIDR ranges between the Atlas VPC and customer VPC, plus matching routes and security group rules; peering is not transitive.

AWS PrivateLink, Azure Private Link, and GCP Private Service Connect expose Atlas dedicated clusters through private endpoints; they require M10 or higher.

Private endpoint DNS must resolve Atlas hostnames to the private IP address; public DNS or an incorrectly linked private zone breaks connections.

The mongodb+srv connection format uses DNS SRV and TXT records to discover hosts and options; the standard mongodb:// format lists seed hosts explicitly.

Atlas requires TLS for all connections and listens on port 27017 by default; drivers should enable TLS and validate the server certificate.

Choose a cluster region close to the application; multi-region clusters reduce read latency but increase write latency and cost because writes cross regions.

Atlas monitoring metrics include CPU utilization, memory, disk IOPS, disk usage, connections, opcounters, replication lag, query targeting, and scan-and-order ratio.

Query Targeting ratio equals documents examined divided by documents returned; values well above 1 indicate the query scans many documents for few results.

Scan and Order ratio compares documents scanned with documents returned; a high value can indicate a collection scan or an in-memory sort.

Performance Advisor groups slow query shapes and recommends indexes; Query Profiler shows recent slow operations; Real-Time Performance Panel shows current activity.

explain('executionStats') reports totalDocsExamined, totalKeysExamined, and nReturned; comparing them shows whether an index is selective.

Profiler level 0 is off, level 1 logs operations slower than slowms, and level 2 logs all operations; Atlas exposes profiler data in the Query Profiler.

Alert notifications can target email, SMS, Slack, PagerDuty, webhooks, and Datadog; alerts can be configured at project or organization level.

Connection limits depend on cluster tier; maxPoolSize controls per-driver pool size and should stay below the cluster connection limit.

Cloud Backup with continuous snapshots is available on M10 and higher; M0, M2, and M5 clusters do not have Atlas-managed backups.

Point-in-time recovery replays oplog entries from a base snapshot to a selected timestamp within the retention window.

Snapshot retention policies define hourly, daily, weekly, and monthly retention; they determine which restore points remain available.

Atlas restore options include restoring a snapshot to a new or existing cluster, downloading a snapshot, and point-in-time restore.

Logical backup tools are mongodump and mongorestore; mongodump --archive --gzip writes a single compressed BSON archive; indexes are restored by mongorestore.

mongoexport and mongoimport handle JSON or CSV but do not preserve all BSON types or indexes; they are suited to data exchange, not full backups.

Backup snapshots are encrypted at rest; restoring across projects requires the target project and sufficient cluster tier capacity.

Restore validation checks document counts, indexes, and application queries; restoring to an isolated cluster avoids overwriting production.

Atlas Administration API v2 base URL is https://cloud.mongodb.com/api/atlas/v2; requests use HTTP Digest authentication with a public API key and private API key.

Organization API keys can manage organization-level resources and multiple projects; project API keys are scoped to one project.

Atlas CLI commands map to API operations, for example atlas clusters create, atlas dbusers create, and atlas backups snapshots list.

The Terraform provider uses resources such as mongodbatlas_project, mongodbatlas_cluster, mongodbatlas_database_user, and mongodbatlas_project_ip_access_list.

The Atlas Kubernetes Operator reconciles custom resources for projects, clusters, and users with Atlas, enabling GitOps-style management from Kubernetes.

API list endpoints use pagination parameters such as pageNum and itemsPerPage; clients must handle rate limiting and retry safe requests.

mongosh is an interactive and scriptable MongoDB shell; it can run admin commands against Atlas but does not create Atlas clusters or users.

Secrets such as API private keys and database passwords should be stored in a secrets manager and injected at runtime, not committed to Terraform or Git.

Atlas Live Migration pulls data from a source replica set or sharded cluster into Atlas while writes continue; a final cutover stops writes and switches applications.

mongomirror powers live migration by tailing the source oplog and applying changes to Atlas until cutover; the source must retain enough oplog history.

mongosync performs cluster-to-cluster synchronization and supports continuous sync with a reversible cutover for supported MongoDB versions.

mongodump and mongorestore migrate BSON data and indexes for offline moves; --archive and --gzip reduce file count and size.

mongoexport and mongoimport move JSON or CSV data; they do not preserve all BSON types or indexes and are not full-fidelity migrations.

Live migration requires network access from Atlas to the source, source credentials with read and oplog access, and an allowed source IP range.

Cutover steps include quiescing source writes, waiting for replication lag to reach zero, stopping the migration, and updating connection strings.

Sharded cluster migrations require planning for chunk balancing and shard key distribution; mongosync can synchronize sharded clusters in supported versions.

MongoServerSelectionError indicates the driver cannot reach a suitable server; check DNS/SRV resolution, IP access list, TLS, cluster state, and private endpoint DNS.

Authentication failed indicates invalid credentials or mechanism; verify username, password, authSource, and whether the database user exists in the project.

not authorized on indicates the authenticated user lacks a required privilege; inspect built-in or custom roles and the authentication database.

High replication lag can result from network latency, primary write spikes, secondary CPU or IOPS saturation, or long-running operations.

Disk usage alerts at 90% or higher require immediate action: enable storage autoscaling, increase tier, or remove data before writes fail.

Slow queries are diagnosed with explain executionStats, the Query Profiler, and Performance Advisor; indexes address high documents-examined ratios.

Atlas maintenance performs rolling restarts; replica set elections occur, and drivers with retryable writes and SRV discovery reconnect automatically.

Operational readiness includes tested failover, restore drills, alert routing, and runbooks for connection, authentication, and disk incidents.