# Getting Started With Atlas Stream Processing Security

Security is paramount in the realm of databases, and the safeguarding of streaming data is no exception. Stream processing services like Atlas Stream Processing handle sensitive data from a variety of sources, making them prime targets for malicious activities. Robust security measures, including encryption, access controls, and authentication mechanisms, are essential to mitigating risks and upholding the trustworthiness of the information flowing through streaming data pipelines. 

In addition, regulatory compliance may impose comprehensive security protocols and configurations such as enforcing auditing and separation of duties. In this article, we will cover the security capabilities of Atlas Stream Processing, including access control, and how to configure your environment to support least privilege access. Auditing and activity monitoring will be covered in a future article.

## A primer on Atlas security

Recall that in MongoDB Atlas, organizations, projects, and clusters are hierarchical components that facilitate the organization and management of MongoDB resources. An organization is a top-level entity representing an independent deployment of MongoDB Atlas, and it contains one or more projects. 

A project is a logical container within an organization, grouping related resources and serving as a unit for access control and billing. Within a project, MongoDB clusters are deployed. Clusters are instances of MongoDB databases, each with its own configurations, performance characteristics, and data. Clusters can span multiple cloud regions and availability zones for high availability and disaster recovery. 

This hierarchy allows for the efficient management of MongoDB deployments, access control, and resource isolation within MongoDB Atlas.

 authenticate with Atlas UI, API, or CLI only (a.k.a the control plane). Authorization includes access to an Atlas organization and the Atlas projects within the organization. 

 or via a MongoDB driver like the MongoDB Java driver. If you have previously used a self-hosted MongoDB server, Atlas database users are the equivalent of the MongoDB user. MongoDB Atlas supports a variety of authentication methods such as SCRAM (username and password), LDAP Proxy Authentication, OpenID Connect, Kerberos, and x.509 Certificates. While clients use any one of these methods to authenticate, Atlas services, such as Atlas Data Federation, access other Atlas services like Atlas clusters via temporary x.509 certificates. This same concept is used within Atlas Stream Processing and will be discussed later in this post.

**Note:** Unless otherwise specified, a “user” in this article refers to an Atlas database user.

.

Authentication to SPIs operates similarly to Atlas clusters, where only users defined within the Atlas data plane (e.g., Atlas database users) are allowed to connect to and create SPIs. It's crucial to grasp this concept because SPIs and Atlas clusters are distinct entities within an Atlas project, yet they share the same authentication process via Atlas database users.

By default, **only Atlas users who are Project Owners or Project Stream Processing Owners can create Stream Processing Instances.** These users also have the ability to create, update, and delete connection registry connections associated with SPIs. 

### Connecting to the Stream Processing Instance

Once the SPI is created, Atlas database users can connect to it just as they would with an Atlas cluster through a client tool such as mongosh. Any Atlas database user with the built-in “readWriteAnyDatabase” or “atlasAdmin” can connect to any SPIs within the project.

For users without one of these built-in permissions, or for scenarios where administrators want to follow the principle of least privilege, administrators can create a custom database role made up of specific actions.

#### Custom actions

Atlas Stream Processing introduces a number of custom actions that can be assigned to a custom database role. For example, if administrators wanted to create an operations-level role that could only start, stop, and view stream statistics, they could create a database user role, “ASPOps,” and add the startStreamProcessor, stopStreamProcessor, and listStreamProcessors actions. The administrator would then grant this role to the user. 

The following is a list of Atlas Stream Processing actions:

- createStreamProcessor
- processStreamProcessor
- startStreamProcessor
- stopStreamProcessor
- dropStreamProcessor
- sampleStreamProcessor
- listStreamProcessors
- listConnections
- streamProcessorStats

One issue you might realize is if a database user with the built-in “readWriteAnyDatabase” has all these actions granted by default, or if a custom role has these actions, they have these action permissions for all Stream Processing Instances within the Atlas project! If your organization wants to lock this down and restrict access to specific SPIs, they can do this by navigating to the “Restrict Access” section and selecting the desired SPIs.

 or read more about MongoDB Atlas Stream Processing in our documentation.

  [1]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/blt493531d0261fd667/6629225351b16f1ecac4e6cd/1.png
  [2]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/blt5a6ba7eaf44c67a2/662922674da2a996e6ff2ea8/2.png
  [3]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/bltcdd67839c2a52fa2/6629227fb0ec7701ffd6e743/3.png
  [4]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/blt5188a9aabfeae08c/66292291b0ec775eb8d6e747/4.png
  [5]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/blt586319eaf4e5422b/662922ab45f9893914cf6a93/5.png
  [6]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/blt7cfd6608d0aca8b0/662922c3b054410cfd9a038c/6.png
  [7]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/bltb01ee1b6f7f4b89c/662922d9c9de46ee62d4944f/7.png
  [8]: https://images.contentstack.io/v3/assets/blt39790b633ee0d5a7/bltc251c6f17b584861/662922edb0ec77eee0d6e750/8.png