Weekly

Audit Atlas IP access lists weekly

Each week you see who can reach every project, with open-to-all entries and new additions called out.

Runs: Weekly
Apps: MongoDB
AI: Not needed
Access: Project Read Only

Send this to your assistant

Create a ClickRuntime automation: every Monday, email me the IP access list of each Atlas project, and mark any 0.0.0.0/0 entry and anything added since last Monday.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

An Atlas project's IP access list controls which addresses can reach your databases. In a hurry, someone adds 0.0.0.0/0 to get a deployment working from a laptop at home or a serverless function, and intends to remove it later. It stays for months. A cluster open to the whole internet is protected only by its credentials, which is a risk many teams only learn about after a scan or a breach.

Each week ClickRuntime lists your Atlas projects and the access list entries in each, flags any that allow 0.0.0.0/0, compares the rest against the list it stored last time, and emails what is new or too open. The first run records a baseline, and later runs report differences.

Security-minded founders and small platform teams without a dedicated security tool use it as a lightweight control.

What you get out of it

Open-to-everyone rules are caught
A single entry for 0.0.0.0/0 is reported by name and project. It cannot hide in the list for months because the email names it every week until it is removed.
New entries are reviewed
Any address added since last week appears as new, along with its comment if one was set. A suspicious IP or a contractor's old address can be questioned while it is still recent.
A record for security questionnaires
Customers ask how network access is controlled. Weekly emails showing the access list was reviewed provide evidence without building a separate process. People fix the rule as soon as the report begins naming it, and temporary open rules stop being left in place for months.
Shortcuts are corrected
Because temporary allowances are reported until fixed, the habit of adding open rules for convenience fades. People switch to private endpoints or specific addresses. The habit of adding wide-open rules for convenience fades once the report calls them out every week.
Review time becomes minutes
Reading a one-line summary per project replaces opening each Atlas project's network access page. A task that was skipped for months becomes routine. Reading a short summary per project replaces opening each project's network access page, so a skipped chore becomes routine.

How it works

What happens, step by step

Every week ClickRuntime reads the IP access list of each of your MongoDB Atlas projects.
It compares the entries with last week's list.
Any entry open to the whole internet, and any entry added since last week, is called out.
The audit arrives in your inbox, grouped by project.

Before it runs live

Connect MongoDB

What you get

RunsWeekly

Audit Atlas IP access lists weeklytoday, 9:00Succeeded

Email · Access list auditacme-prod 0.0.0.0/0 temp debug [OPEN TO ALL] [NEW] 203.0.113.4/32 office

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other MongoDB steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

get_a_weekly_ip_access_list_audit.pyexample

from clickruntime import on_trigger, credentials, http, notify, state

from requests.auth import HTTPDigestAuth

ATLAS = "https://cloud.mongodb.com/api/atlas/v2"

def atlas(path, **params):
    auth = HTTPDigestAuth(credentials.secret("ATLAS_PUBLIC_KEY"), credentials.secret("ATLAS_PRIVATE_KEY"))
    resp = http.get(f"{ATLAS}{path}", auth=auth, params=params, headers={"Accept": "application/vnd.atlas.2024-08-05+json"})
    resp.raise_for_status()
    return resp.json()

@on_trigger
def run(event):
    previous = set(state.get("entries") or [])
    current, lines = [], []
    for g in atlas("/groups")["results"]:
        lines.append(f"\n{g['name']}")
        for e in atlas(f"/groups/{g['id']}/accessList")["results"]:
            cidr = e.get("cidrBlock") or e.get("ipAddress")
            key = f"{g['id']}:{cidr}"
            flags = (" [OPEN TO ALL]" if cidr == "0.0.0.0/0" else "") + (" [NEW]" if previous and key not in previous else "")
            lines.append(f"  {cidr} {e.get('comment', '')}{flags}")
            current.append(key)
    notify.email_me("Atlas IP access lists", "\n".join(lines).strip())
    state.set("entries", current)
    return {"entries": len(current)}

FAQ

Common questions

Does it flag IPv6 open ranges?

It flags the standard open IPv4 range 0.0.0.0/0 and can also flag ::/0 for IPv6. Overly wide ranges, such as a /8 block, can be added to the rule if your policy treats them as too open.

Will it remove risky entries for me?

No. It reports only. Removing an access list entry could cut off a live application, so a person decides. The report names the project and entry so the fix takes one click in Atlas. The email links the project and entry so that the fix itself takes only a minute in Atlas.

What Atlas role is needed?

A programmatic API key with Project Read Only on each project is enough to read the access list. The key is stored as a secret and used only for read requests. It never adds or removes entries, and the key can be revoked in Atlas at any time.

What permissions does it need?

Project Read Only. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (weekly). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Daily