{"resources":{"mongodbatlas":{"id":"mongodbatlas","name":"mongodbatlas","fields":{"aiModelApiKey":{"name":"aiModelApiKey","type":"\u001bmongodbatlas.aiModelApiKey","title":"MongoDB Atlas AI model API key","desc":"A credential the organization holds for an embedding or reranking service, keyed by key id. Covers the name it was registered under, its status, the cloud and geography it is scoped to, the endpoint it reaches, who created it and when, and when it was last used. The key secret is never exposed. A key whose lastUsedAt is null or long past is an unattended credential that still authorizes calls, and status is what separates a disabled key from a live one.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"aiModelApiKeys":{"name":"aiModelApiKeys","type":"\u0019\u001bmongodbatlas.aiModelApiKey","title":"AI model API keys registered on the organization","desc":"Credentials Atlas holds for an embedding or reranking service. The key secret is never exposed; status and lastUsedAt are what identify a stale or unattended credential.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"alertConfig":{"name":"alertConfig","type":"\u001bmongodbatlas.alertConfig","title":"MongoDB Atlas alert configuration","desc":"One alert rule on the project, keyed by configuration id. Covers the event type that fires it, whether it is enabled, the matchers that limit it to particular objects, the metric threshold that a metric alert compares against, and the notification targets it reaches. The set of configurations is the project's detection coverage, so an event type that no enabled configuration names is an event nobody is told about. Select a configuration by event type, for example `mongodbatlas.alertConfigs.where(eventTypeName == \"NO_PRIMARY\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"alertConfigs":{"name":"alertConfigs","type":"\u0019\u001bmongodbatlas.alertConfig","title":"Alert configurations defined on the project","desc":"Detection coverage for the project. Each configuration names the event type that triggers it, whether it is enabled, the matchers that narrow it to particular objects, and the targets that receive the notification. Reading the set is how a check for coverage of events such as JOINED_GROUP, USER_ROLES_CHANGED_AUDIT, or NO_PRIMARY is written.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"alertNotification":{"name":"alertNotification","type":"\u001bmongodbatlas.alertNotification","title":"MongoDB Atlas alert notification target","desc":"One destination an alert configuration delivers to. Covers the target kind, the address or channel it reaches, the roles it is limited to for a role-based target, and the delay and repeat intervals. Only non-credential fields are exposed: the Atlas notification record carries API tokens, integration keys, and a webhook secret inline, and none of those are read. A webhook target reports only its host through webhookUrlHost, and hasWebhookSecret reports whether the delivery is signed.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"apiAccessListEntry":{"name":"apiAccessListEntry","type":"\u001bmongodbatlas.apiAccessListEntry","title":"MongoDB Atlas API access list entry","desc":"A single source address that a programmatic credential (an API key or a service account) may authenticate from, keyed by the CIDR block or address it grants. A credential with no entries is usable from anywhere on the internet, so an empty access list is the condition to audit for, and the organization setting apiAccessListRequired reports whether Atlas enforces that an entry exists. Covers the granted CIDR block or single address, when the entry was created, and how it has been used: the number of requests seen from it, the last time it was used, and the address that used it. An entry that has never been used reports a null lastUsed, which identifies stale allowances that can be withdrawn.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"apiAccessListRequired":{"name":"apiAccessListRequired","type":"\u0004","title":"Whether an API access list is required for organization API keys and service accounts","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"apiKey":{"name":"apiKey","type":"\u001bmongodbatlas.apiKey","title":"MongoDB Atlas programmatic API key","desc":"A programmatic API key in the organization, keyed by its public key. Covers the description and the roles the key is granted at the organization and project level. The private key is never exposed. Select a key by public key, for example `mongodbatlas.apiKeys.where(description == \"ci\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"apiKeys":{"name":"apiKeys","type":"\u0019\u001bmongodbatlas.apiKey","title":"Programmatic API keys in the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"auditConfig":{"name":"auditConfig","type":"\u001bmongodbatlas.auditConfig","title":"MongoDB Atlas database auditing configuration","desc":"The database auditing settings for the project. Covers whether auditing is enabled, whether authorization successes are audited (not just failures), the audit filter, and how the filter was configured.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"auditing":{"name":"auditing","type":"\u001bmongodbatlas.auditConfig","title":"Database auditing configuration for the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"backupComplianceConfig":{"name":"backupComplianceConfig","type":"\u001bmongodbatlas.backupComplianceConfig","title":"MongoDB Atlas Backup Compliance Policy","desc":"The Backup Compliance Policy for the project, the anti-ransomware immutability guardrail that prevents backups from being modified or deleted before their retention period expires. Covers whether copy protection and encryption at rest are enforced, whether point-in-time recovery is required, the restore window, the authorized security contact, the enablement state, and the on-demand and scheduled retention policy items. Present only when a Backup Compliance Policy has been configured, and null otherwise.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"backupCompliancePolicy":{"name":"backupCompliancePolicy","type":"\u001bmongodbatlas.backupComplianceConfig","title":"Backup Compliance Policy for the project","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"backupScheduleConfig":{"name":"backupScheduleConfig","type":"\u001bmongodbatlas.backupScheduleConfig","title":"Cloud backup schedule for a cluster","desc":"The snapshot schedule and retention policy in effect for one cluster, which governs how often snapshots are taken, how long each is kept, how far back point-in-time restores reach, and whether snapshots are copied to other regions or exported to cloud storage. The cluster backupEnabled field only reports that backups run at all, so the retention policy items here are what a recovery-objective audit actually needs. Null when the cluster has cloud backup disabled, which is the case for Flex and shared tier deployments.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"cloudProviderAccessRole":{"name":"cloudProviderAccessRole","type":"\u001bmongodbatlas.cloudProviderAccessRole","title":"MongoDB Atlas cloud provider access role","desc":"A cloud provider identity (an AWS IAM role, Azure service principal, or GCP service account) that Atlas assumes to access customer cloud resources such as customer-managed encryption keys, keyed by roleId. Covers the provider, the assumed identity, and when it was authorized.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"cloudProviderAccessRoles":{"name":"cloudProviderAccessRoles","type":"\u0019\u001bmongodbatlas.cloudProviderAccessRole","title":"Cloud provider access roles configured for the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"cluster":{"name":"cluster","type":"\u001bmongodbatlas.cluster","title":"MongoDB Atlas cluster","desc":"A database cluster (deployment) in the project, keyed by name. Covers the MongoDB version and release track, cluster topology, backup and point-in-time-recovery state, encryption-at-rest provider, the minimum enabled TLS protocol, client-log redaction, termination protection, and the per-region provider and instance sizing. The connection strings report how clients reach the cluster, over the public internet or through a peered network or private endpoint, and employeeAccessGrantType reports whether MongoDB support staff currently hold access to it. Flex tier deployments come from a separate endpoint and appear under flexClusters instead. Select a cluster by name, for example `mongodbatlas.clusters.where(name == \"prod-0\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"clusterAdvancedConfig":{"name":"clusterAdvancedConfig","type":"\u001bmongodbatlas.clusterAdvancedConfig","title":"MongoDB Atlas cluster advanced configuration","desc":"The process-level settings in effect for one cluster, which the cluster listing does not carry. Covers whether the cluster executes server-side JavaScript, whether it refuses queries that require a collection scan, the minimum TLS version and the cipher suites actually offered when the cipher mode is CUSTOM, the oplog retention window that bounds how far a point-in-time restore reaches, the default write concern applied when a driver names none, and the query-plan logging verbosity. A setting the cluster leaves at the Atlas default reads null rather than a value.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"clusters":{"name":"clusters","type":"\u0019\u001bmongodbatlas.cluster","title":"Clusters in the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"connectedOrgConfig":{"name":"connectedOrgConfig","type":"\u001bmongodbatlas.connectedOrgConfig","title":"MongoDB Atlas connected organization","desc":"The link between one organization and an identity federation, keyed by organization id. Covers whether sign-in is restricted to the federated domains, which domains those are, the roles every federated user receives on sign-in regardless of any mapping, whether just-in-time user provisioning is switched off, the identity provider that authenticates sign-in, the providers authorized for database access, and the mappings from provider group to Atlas role. postAuthRoleGrants is a blanket grant, so a privileged role listed there reaches every user the provider authenticates.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"customDatabaseRole":{"name":"customDatabaseRole","type":"\u001bmongodbatlas.customDatabaseRole","title":"MongoDB Atlas custom database role","desc":"A user-defined database role in the project, keyed by role name. Covers the individual privilege actions the role grants (each with the cluster, database, and collection resources it applies to) and the built-in or custom roles it inherits. Auditing custom roles surfaces over-privileged or privilege-escalating grants beyond the built-in roles. Select a role by name, for example `mongodbatlas.customDatabaseRoles.where(roleName == \"appReadWrite\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"customDatabaseRoles":{"name":"customDatabaseRoles","type":"\u0019\u001bmongodbatlas.customDatabaseRole","title":"Custom database roles defined in the project","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"dataFederation":{"name":"dataFederation","type":"\u001bmongodbatlas.dataFederation","title":"MongoDB Atlas federated database instance","desc":"A federated database instance in the project, keyed by tenant name. It serves queries over data that lives outside the cluster, in customer cloud storage and in other Atlas clusters, so the stores it reads and the cloud provider access role it assumes describe a data path the cluster and network settings do not. Covers the tenant name and state, the hostnames clients connect to, the region queries are processed in, the private endpoints that reach it, and the store definitions behind it. Select an instance by name, for example `mongodbatlas.dataFederations.where(name == \"analytics\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"dataFederations":{"name":"dataFederations","type":"\u0019\u001bmongodbatlas.dataFederation","title":"Federated database instances in the project","desc":"Each instance queries data held in customer cloud storage under a cloud provider access role, which is a data path that neither the cluster settings nor the network settings describe.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"databaseUser":{"name":"databaseUser","type":"\u001bmongodbatlas.databaseUser","title":"MongoDB Atlas database user","desc":"A database user in the project, keyed by the username and authentication database. Covers the authentication mechanism (SCRAM, X.509, AWS IAM, LDAP, or OIDC), the granted roles, the scopes limiting which clusters the user may access, and any automatic deletion time. The password is never exposed. Select a user by username, for example `mongodbatlas.databaseUsers.where(username == \"app\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"databaseUserCertificate":{"name":"databaseUserCertificate","type":"\u001bmongodbatlas.databaseUserCertificate","title":"MongoDB Atlas managed X.509 certificate","desc":"One certificate Atlas issued to a database user for X.509 authentication, keyed by certificate id. Covers the subject the certificate authenticates as, when it was issued, and when it expires. A user whose x509Type is MANAGED but whose certificates have all passed their notAfter can no longer authenticate, and one that expires soon is a scheduled outage.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"databaseUsers":{"name":"databaseUsers","type":"\u0019\u001bmongodbatlas.databaseUser","title":"Database users in the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"encryptionAtRest":{"name":"encryptionAtRest","type":"\u001bmongodbatlas.encryptionConfig","title":"Encryption-at-rest configuration for the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"encryptionConfig":{"name":"encryptionConfig","type":"\u001bmongodbatlas.encryptionConfig","title":"MongoDB Atlas encryption-at-rest configuration","desc":"The customer-managed encryption-at-rest settings for the project. Covers whether encryption at rest with a customer key is enabled for each cloud provider (AWS KMS, Azure Key Vault, Google Cloud KMS) and for search nodes. Key material is never exposed.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"federationConfig":{"name":"federationConfig","type":"\u001bmongodbatlas.federationConfig","title":"MongoDB Atlas identity federation settings","desc":"Organization-level identity federation configuration. Covers the connected identity provider and its status, whether role mappings are configured, the domains the organization has federated, and the identity providers linked to the federation. Present only when the organization has federation configured, and null otherwise.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"federationSettings":{"name":"federationSettings","type":"\u001bmongodbatlas.federationConfig","title":"Identity federation settings for the organization","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"flexCluster":{"name":"flexCluster","type":"\u001bmongodbatlas.flexCluster","title":"MongoDB Atlas Flex cluster","desc":"A Flex tier database deployment in the project, keyed by name. Flex clusters come from a separate endpoint than dedicated and shared tier deployments, so they do not appear under clusters and a project holding only Flex deployments looks empty there. Covers the running MongoDB version and release track, the cloud provider and region backing the deployment, storage capacity, backup state, termination protection, and the resource tags applied. Select a Flex cluster by name, for example `mongodbatlas.flexClusters.where(name == \"flex-0\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"flexClusters":{"name":"flexClusters","type":"\u0019\u001bmongodbatlas.flexCluster","title":"Flex clusters in the project","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"genAiFeaturesEnabled":{"name":"genAiFeaturesEnabled","type":"\u0004","title":"Whether generative AI features are enabled for the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"identityProvider":{"name":"identityProvider","type":"\u001bmongodbatlas.identityProvider","title":"MongoDB Atlas identity provider","desc":"A SAML or OIDC identity provider linked to the organization's federation, keyed by id. Covers the protocol and provider type, the activation status, the issuer and associated domains, and the protocol-specific settings that matter for sign-in security (SAML request binding, response signature algorithm, and SSO debug mode; OIDC authorization type, client id, and requested scopes). Read providers from the federation settings, for example `mongodbatlas.federationConfig.identityProviders.where(ssoDebugEnabled == true)`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"ipAccessList":{"name":"ipAccessList","type":"\u0019\u001bmongodbatlas.networkAccessEntry","title":"Project IP access list entries","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"maintenanceWindow":{"name":"maintenanceWindow","type":"\u001bmongodbatlas.maintenanceWindowConfig","title":"Maintenance window configured for the project","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"maintenanceWindowConfig":{"name":"maintenanceWindowConfig","type":"\u001bmongodbatlas.maintenanceWindowConfig","title":"MongoDB Atlas maintenance window","desc":"The weekly window in which Atlas applies maintenance to the project's clusters. Covers the day and hour it starts, the hours maintenance is kept out of, whether the window auto-defers on first use, and how many times the currently scheduled maintenance has been deferred. Repeated deferral is how a cluster stays on an unpatched build, and numberOfDeferrals is what makes that countable.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"maxServiceAccountSecretValidityInHours":{"name":"maxServiceAccountSecretValidityInHours","type":"\u0005","title":"Maximum validity in hours for service account secrets, 0 when unlimited","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mcpConfiguration":{"name":"mcpConfiguration","type":"\u001bmongodbatlas.mcpConfiguration","title":"MongoDB Atlas Remote MCP configuration","desc":"A configuration that exposes Atlas through the Remote MCP endpoint, which is how an MCP client such as an AI agent reads and acts on the deployment. Each configuration authenticates as a service account and carries the roles that account holds plus the addresses it may connect from, so it is a standing non-human path into the data that outlives any individual session. Reports the roles granted, the service account behind the configuration, and the source restriction, which is the control that keeps the endpoint from being reachable by anyone holding the credentials. Configurations exist at both organization and project scope and the scope field says which this one is. Keyed by id.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"mcpConfigurations":{"name":"mcpConfigurations","type":"\u0019\u001bmongodbatlas.mcpConfiguration","title":"Remote MCP configurations defined at the organization","desc":"Each configuration lets an MCP client reach Atlas with organization-wide roles, so this is the organization's inventory of agent access.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"metricIntegration":{"name":"metricIntegration","type":"\u001bmongodbatlas.metricIntegration","title":"MongoDB Atlas metric integration","desc":"One OpenTelemetry export destination on the project, keyed by integration id. Covers the protocol, the provider the collector belongs to, the authentication method used against it, the aggregation temporality, and which metric categories are exported. Header values are redacted by Atlas and only the header names are exposed, and the collector address is reduced to its host. This is a separate export path from the third-party service integrations, so both have to be read to see everywhere project telemetry goes.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"metricIntegrations":{"name":"metricIntegrations","type":"\u0019\u001bmongodbatlas.metricIntegration","title":"OpenTelemetry metric integrations configured on the project","desc":"Telemetry export over OTLP, a destination set kept separately from the third-party service integrations. Each entry names the protocol, the authentication method, the collector host, and which metric categories leave the project. Header values are redacted by Atlas and only the header names are exposed.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"multiFactorAuthRequired":{"name":"multiFactorAuthRequired","type":"\u0004","title":"Whether multi-factor authentication is required for all organization members","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"networkAccessEntry":{"name":"networkAccessEntry","type":"\u001bmongodbatlas.networkAccessEntry","title":"MongoDB Atlas project IP access list entry","desc":"A single entry in the project's IP access list, keyed by its CIDR block or IP address. Only clients matching an entry may reach the project's clusters. Covers the CIDR block or address, an optional AWS security group, and any automatic expiry. Select an entry by value, for example `mongodbatlas.ipAccessList.where(cidrBlock == \"10.0.0.0/24\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"networkPeering":{"name":"networkPeering","type":"\u001bmongodbatlas.networkPeering","title":"MongoDB Atlas network peering connection","desc":"A VPC or VNet peering connection between the project's Atlas network and a customer network, keyed by id. Covers the cloud provider, the peered network identifiers, and the connection status. Fields vary by provider.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"networkPeerings":{"name":"networkPeerings","type":"\u0019\u001bmongodbatlas.networkPeering","title":"Network peering connections for the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"onlineArchive":{"name":"onlineArchive","type":"\u001bmongodbatlas.onlineArchive","title":"MongoDB Atlas online archive","desc":"An archiving rule on one cluster collection, keyed by archive id. Documents matching the rule move out of the cluster into a separate managed store with its own retention and its own query endpoint, so the cluster's backup, encryption, and network settings stop applying to them. Covers the source database and collection, the archiving criteria and the schedule they run on, whether the rule is paused, the region the archive is processed in, and the expiry rule that deletes archived data.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"orgUser":{"name":"orgUser","type":"\u001bmongodbatlas.orgUser","title":"MongoDB Atlas organization member","desc":"A user account that is a member of the organization, keyed by username (the login email). Covers the membership status, the organization-level roles, per-project role assignments, team memberships, and the last authentication time. A member whose orgMembershipStatus is PENDING has been invited but has never signed in, and the invitation fields report when that invitation was sent, when it expires, and who sent it. Select a member by username, for example `mongodbatlas.orgUsers.where(username == \"alice@example.com\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"orgUsers":{"name":"orgUsers","type":"\u0019\u001bmongodbatlas.orgUser","title":"Organization members","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"organizationId":{"name":"organizationId","type":"\u0007","title":"Organization id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"organizationName":{"name":"organizationName","type":"\u0007","title":"Organization name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"privateEndpointService":{"name":"privateEndpointService","type":"\u001bmongodbatlas.privateEndpointService","title":"MongoDB Atlas private endpoint service","desc":"A private endpoint service configured for the project on a single cloud provider, keyed by id. Private endpoints let clients reach clusters over the cloud provider's private network instead of the public internet. Covers the cloud provider, region, status, and the underlying endpoint identifiers.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"privateEndpoints":{"name":"privateEndpoints","type":"\u0019\u001bmongodbatlas.privateEndpointService","title":"Private endpoint services configured for the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"project":{"name":"project","type":"\u001bmongodbatlas.project","title":"MongoDB Atlas project","desc":"A project (also called a group) in the organization, keyed by id. Covers the owning organization, the number of clusters, the creation time, and any government region restrictions. Select a project by name, for example `mongodbatlas.projects.where(name == \"production\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"projectConfig":{"name":"projectConfig","type":"\u001bmongodbatlas.projectConfig","title":"MongoDB Atlas project feature settings","desc":"Feature toggles for the project, such as whether the Data Explorer and its generative AI features are enabled and whether the performance and schema advisors are active. These govern which in-console data-access and analysis features are exposed.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"projectInvitation":{"name":"projectInvitation","type":"\u001bmongodbatlas.projectInvitation","title":"MongoDB Atlas project invitation","desc":"An invitation to the project that has been sent and not accepted, keyed by invitation id. Covers the invited address, the roles the invitation carries, who sent it, when it was sent, and when it expires. Until it expires or is withdrawn, it is a standing grant to whoever controls the invited address.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"projectInvitations":{"name":"projectInvitations","type":"\u0019\u001bmongodbatlas.projectInvitation","title":"Invitations to the project that have not been accepted","desc":"An invitation that was sent and never accepted is a standing grant to whoever controls the invited address, carrying the roles it was issued with until it expires or is withdrawn.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projectMcpConfigurations":{"name":"projectMcpConfigurations","type":"\u0019\u001bmongodbatlas.mcpConfiguration","title":"Remote MCP configurations defined on the project","desc":"The project-scoped equivalent of the organization list. A project can carry its own configurations independently of the organization, so both have to be read to see every path an agent has into the data.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projectSettings":{"name":"projectSettings","type":"\u001bmongodbatlas.projectConfig","title":"Project feature settings","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projectTeam":{"name":"projectTeam","type":"\u001bmongodbatlas.projectTeam","title":"MongoDB Atlas project team grant","desc":"A team granted roles on the project. The grant is what gives every member of the team the named roles, so a team with a broad membership and a GROUP_OWNER grant reaches further than any individual assignment shows. Resolving the team itself needs organization access, so team is null when the connected credential is scoped to the project.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"projectTeams":{"name":"projectTeams","type":"\u0019\u001bmongodbatlas.projectTeam","title":"Teams granted a role on the project","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projectUser":{"name":"projectUser","type":"\u001bmongodbatlas.projectUser","title":"MongoDB Atlas project member","desc":"A user holding at least one role on the project, keyed by user id. Covers the login name, the project roles held, the organization membership status, the last authentication time, and the invitation fields for a member who has been invited but has never signed in. Project-scoped access is otherwise only visible from the organization side, which a project-scoped credential cannot read. Select a member by username, for example `mongodbatlas.projectUsers.where(username == \"alice@example.com\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"projectUsers":{"name":"projectUsers","type":"\u0019\u001bmongodbatlas.projectUser","title":"Members holding a role on the project","desc":"Project-scoped membership as the project sees it, including members whose organization membership is still PENDING.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projects":{"name":"projects","type":"\u0019\u001bmongodbatlas.project","title":"Projects in the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"pushBasedLogConfig":{"name":"pushBasedLogConfig","type":"\u001bmongodbatlas.pushBasedLogConfig","title":"MongoDB Atlas push-based log export configuration","desc":"The push-based log export configuration for the project, which delivers database audit and access logs to a customer-owned AWS S3 bucket. Covers the destination bucket, the AWS IAM role Atlas assumes to write to it, the object key prefix, and the configuration state. Present only when push-based log export has been configured, and null otherwise.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"pushBasedLogExport":{"name":"pushBasedLogExport","type":"\u001bmongodbatlas.pushBasedLogConfig","title":"Push-based log export configuration for the project","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"resourcePolicies":{"name":"resourcePolicies","type":"\u0019\u001bmongodbatlas.resourcePolicy","title":"Organization resource policies (Atlas Resource Policies)","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"resourcePolicy":{"name":"resourcePolicy","type":"\u001bmongodbatlas.resourcePolicy","title":"MongoDB Atlas resource policy","desc":"An organization-level Atlas Resource Policy, keyed by id. Resource policies are Cedar-based guardrails that constrain what actions can be taken on Atlas resources across the organization (for example restricting the cloud providers or regions clusters may deploy to). Covers the name, description, the users and times of creation and last update, and the individual policy statements. Select a policy by name, for example `mongodbatlas.resourcePolicies.where(name == \"restrict-regions\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"restrictEmployeeAccess":{"name":"restrictEmployeeAccess","type":"\u0004","title":"Whether MongoDB support employee access to organization infrastructure is restricted","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roleMapping":{"name":"roleMapping","type":"\u001bmongodbatlas.roleMapping","title":"MongoDB Atlas federation role mapping","desc":"A rule granting Atlas roles to the members of one identity provider group, keyed by mapping id. Covers the external group name and the organization and project roles it confers. This is what answers which provider group grants a privileged role, which the federation-wide hasRoleMappings flag can only say exists. Select a mapping by group, for example `mongodbatlas.federationSettings.connectedOrgConfigs.first.roleMappings.where(externalGroupName == \"atlas-admins\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"searchIndex":{"name":"searchIndex","type":"\u001bmongodbatlas.searchIndex","title":"MongoDB Atlas search or vector search index","desc":"A single Atlas Search or Atlas Vector Search index defined on a cluster, covering both index kinds through the type discriminator: \"search\" for a full-text Atlas Search index and \"vectorSearch\" for an Atlas Vector Search index. Reports the database and collection the index is built on, its build status and whether it is currently queryable, and the full index definition. The latestDefinition field carries the index configuration: for vector search the vector and filter fields with their numDimensions, similarity function, and path, plus numPartitions; for full-text search the analyzer, analyzers, mappings, searchAnalyzer, synonyms, and the storedSource clause that governs which document fields are copied into the index.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"securityContact":{"name":"securityContact","type":"\u0007","title":"Email address that receives security notifications for the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"serviceAccount":{"name":"serviceAccount","type":"\u001bmongodbatlas.serviceAccount","title":"MongoDB Atlas service account","desc":"A service account in the organization, keyed by its client id. Covers the granted organization roles and the secrets issued to it (their ids and expiry times, never the secret values). Select an account by client id, for example `mongodbatlas.serviceAccounts.where(name == \"automation\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"serviceAccounts":{"name":"serviceAccounts","type":"\u0019\u001bmongodbatlas.serviceAccount","title":"Service accounts in the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"snapshotExportBucket":{"name":"snapshotExportBucket","type":"\u001bmongodbatlas.snapshotExportBucket","title":"MongoDB Atlas snapshot export bucket","desc":"A cloud storage bucket that cloud backup snapshots for the project can be exported to, keyed by id. Covers the bucket name, the cloud provider and region holding it, and the cloud provider access role Atlas assumes to write to it. An export bucket is a path for backup data to leave Atlas, so both the destination account and the role authorizing the write are worth auditing.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"snapshotExportBuckets":{"name":"snapshotExportBuckets","type":"\u0019\u001bmongodbatlas.snapshotExportBucket","title":"Cloud storage buckets that cloud backup snapshots can be exported to","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"streamsCrossGroupEnabled":{"name":"streamsCrossGroupEnabled","type":"\u0004","title":"Whether Atlas Stream Processing may connect to clusters in other projects","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"team":{"name":"team","type":"\u001bmongodbatlas.team","title":"MongoDB Atlas team","desc":"A team in the organization, keyed by name. Teams group members for role assignment on projects. Select a team by name, for example `mongodbatlas.teams.where(name == \"platform\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"teams":{"name":"teams","type":"\u0019\u001bmongodbatlas.team","title":"Teams in the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"thirdPartyIntegration":{"name":"thirdPartyIntegration","type":"\u001bmongodbatlas.thirdPartyIntegration","title":"MongoDB Atlas third-party service integration","desc":"One service the project routes alerts and metrics to, keyed by integration type. Covers the service kind, whether it is active, the regional endpoint it uses, the channel or account it delivers into, and which metric categories a metrics integration is allowed to send. The Atlas record carries an API token, an API key, a service key, a licence key, a read and write token, a webhook secret, and a password inline; none are exposed. A destination address is reduced to its host, and hasSecret reports only whether a webhook secret is configured. Select an integration by type, for example `mongodbatlas.thirdPartyIntegrations.where(type == \"WEBHOOK\")`.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"thirdPartyIntegrations":{"name":"thirdPartyIntegrations","type":"\u0019\u001bmongodbatlas.thirdPartyIntegration","title":"Third-party service integrations configured on the project","desc":"Every service the project routes alerts and metrics to, including webhook, Slack, PagerDuty, Datadog, New Relic, Opsgenie, Splunk On-Call, Prometheus, and Microsoft Teams. Credential material is never exposed; hasSecret reports only whether a webhook secret is configured, and a destination address is reduced to its host through endpointHost.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"userSecurity":{"name":"userSecurity","type":"\u001bmongodbatlas.userSecurityConfig","title":"LDAP and customer X.509 authentication settings for the project","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"userSecurityConfig":{"name":"userSecurityConfig","type":"\u001bmongodbatlas.userSecurityConfig","title":"MongoDB Atlas LDAP and X.509 user security settings","desc":"The project's external authentication configuration. Covers the LDAP host used for authentication and authorization, the account Atlas binds with, the authorization query template, the username-to-distinguished-name mappings, and whether a customer certificate authority is configured for X.509 database users. The LDAP bind password and the certificate authority material are never exposed; ldapCaCertificateConfigured and customerX509CasConfigured report only whether each is set. An LDAP host reachable on a port that does not carry TLS makes the credentials that cross it readable in transit.","provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true}},"title":"MongoDB Atlas","desc":"Entry point to a MongoDB Atlas organization and its projects. Connecting to an organization exposes organization-wide security settings and identity through the organizationName, multiFactorAuthRequired, apiAccessListRequired, restrictEmployeeAccess, orgUsers, teams, apiKeys, serviceAccounts, resourcePolicies, and federationSettings fields, and enumerates every project through the projects field, along with the organization's AI model API keys through aiModelApiKeys. Connecting to a single project exposes that project's security surface through the clusters, databaseUsers, customDatabaseRoles, ipAccessList, projectSettings, auditing, encryptionAtRest, backupCompliancePolicy, pushBasedLogExport, privateEndpoints, networkPeerings, and cloudProviderAccessRoles fields, who reaches it through projectUsers, projectTeams, and projectInvitations, its external authentication through userSecurity, its detection and telemetry surface through alertConfigs, thirdPartyIntegrations, and metricIntegrations, its patching cadence through maintenanceWindow, and the data it federates out to customer cloud storage through dataFederations.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/mongodbatlas","root":true},"mongodbatlas.aiModelApiKey":{"id":"mongodbatlas.aiModelApiKey","name":"mongodbatlas.aiModelApiKey","fields":{"cloud":{"name":"cloud","type":"\u0007","is_mandatory":true,"title":"Cloud provider the key is scoped to, ANY when it is cloud-agnostic","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the key was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"Name or id of the user that created the key","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"endpoint":{"name":"endpoint","type":"\u0007","is_mandatory":true,"title":"Service endpoint the key reaches","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"geography":{"name":"geography","type":"\u0007","is_mandatory":true,"title":"Geography the key is scoped to, ANY when it is geography-agnostic","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"API key id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Time the key was last used, null when it has never been used","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name the key was registered under","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"project":{"name":"project","type":"\u001bmongodbatlas.project","title":"Project the key belongs to, null for an organization-wide key","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Current status of the key","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas AI model API key","desc":"A credential the organization holds for an embedding or reranking service, keyed by key id. Covers the name it was registered under, its status, the cloud and geography it is scoped to, the endpoint it reaches, who created it and when, and when it was last used. The key secret is never exposed. A key whose lastUsedAt is null or long past is an unattended credential that still authorizes calls, and status is what separates a disabled key from a live one.","min_provider_version":"13.4.1","defaults":"name status lastUsedAt","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.alertConfig":{"id":"mongodbatlas.alertConfig","name":"mongodbatlas.alertConfig","fields":{"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the configuration was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the configuration is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"eventTypeName":{"name":"eventTypeName","type":"\u0007","is_mandatory":true,"title":"Event type that triggers the alert","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Alert configuration id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"matchers":{"name":"matchers","type":"\u0019\n","is_mandatory":true,"title":"Rules narrowing which objects the configuration applies to, each with fieldName, operator, and value","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"notifications":{"name":"notifications","type":"\u0019\u001bmongodbatlas.alertNotification","title":"Targets that receive the alert","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"severityOverride":{"name":"severityOverride","type":"\u0007","is_mandatory":true,"title":"Severity the event is raised at when the configuration overrides the default","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"thresholdMetricName":{"name":"thresholdMetricName","type":"\u0007","is_mandatory":true,"title":"Metric the alert compares, for a metric-threshold alert","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"thresholdOperator":{"name":"thresholdOperator","type":"\u0007","is_mandatory":true,"title":"Comparison the metric threshold applies (such as GREATER_THAN)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"thresholdUnits":{"name":"thresholdUnits","type":"\u0007","is_mandatory":true,"title":"Unit the threshold value is expressed in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"thresholdValue":{"name":"thresholdValue","type":"\u0006","is_mandatory":true,"title":"Value the metric is compared against","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"updated":{"name":"updated","type":"\t","is_mandatory":true,"title":"Time the configuration was last changed","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas alert configuration","desc":"One alert rule on the project, keyed by configuration id. Covers the event type that fires it, whether it is enabled, the matchers that limit it to particular objects, the metric threshold that a metric alert compares against, and the notification targets it reaches. The set of configurations is the project's detection coverage, so an event type that no enabled configuration names is an event nobody is told about. Select a configuration by event type, for example `mongodbatlas.alertConfigs.where(eventTypeName == \"NO_PRIMARY\")`.","min_provider_version":"13.4.1","defaults":"eventTypeName enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.alertNotification":{"id":"mongodbatlas.alertNotification","name":"mongodbatlas.alertNotification","fields":{"channelName":{"name":"channelName","type":"\u0007","is_mandatory":true,"title":"Slack channel the notification is sent to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"delayMin":{"name":"delayMin","type":"\u0005","is_mandatory":true,"title":"Minutes Atlas waits after the condition is detected before notifying","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"emailAddress":{"name":"emailAddress","type":"\u0007","is_mandatory":true,"title":"Email address the notification is sent to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"emailEnabled":{"name":"emailEnabled","type":"\u0004","is_mandatory":true,"title":"Whether email delivery is enabled for a user, group, or organization target","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"hasWebhookSecret":{"name":"hasWebhookSecret","type":"\u0004","is_mandatory":true,"title":"Whether the webhook delivery is signed with a secret","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"integrationId":{"name":"integrationId","type":"\u0007","is_mandatory":true,"title":"Third-party integration whose credentials the delivery uses","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"intervalMin":{"name":"intervalMin","type":"\u0005","is_mandatory":true,"title":"Minutes between repeat notifications while the alert is unacknowledged","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"notifierId":{"name":"notifierId","type":"\u0007","is_mandatory":true,"title":"Atlas identifier for this notification method","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles the notification is limited to, empty when every role receives it","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"smsEnabled":{"name":"smsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether text message delivery is enabled for a user, group, or organization target","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"teamName":{"name":"teamName","type":"\u0007","is_mandatory":true,"title":"Team the notification is sent to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"typeName":{"name":"typeName","type":"\u0007","is_mandatory":true,"title":"Kind of target (such as EMAIL, GROUP, ORG, USER, TEAM, SLACK, or WEBHOOK)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Atlas username the notification is sent to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"webhookUrlHost":{"name":"webhookUrlHost","type":"\u0007","is_mandatory":true,"title":"Host of the webhook the notification is posted to, null for a non-webhook target","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas alert notification target","desc":"One destination an alert configuration delivers to. Covers the target kind, the address or channel it reaches, the roles it is limited to for a role-based target, and the delay and repeat intervals. Only non-credential fields are exposed: the Atlas notification record carries API tokens, integration keys, and a webhook secret inline, and none of those are read. A webhook target reports only its host through webhookUrlHost, and hasWebhookSecret reports whether the delivery is signed.","private":true,"min_provider_version":"13.4.1","defaults":"typeName","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.apiAccessListEntry":{"id":"mongodbatlas.apiAccessListEntry","name":"mongodbatlas.apiAccessListEntry","fields":{"cidrBlock":{"name":"cidrBlock","type":"\u0007","is_mandatory":true,"title":"CIDR block the credential may authenticate from","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the entry was added to the access list","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"Single IP address the credential may authenticate from","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"lastUsed":{"name":"lastUsed","type":"\t","is_mandatory":true,"title":"Time the entry was last used to authenticate, null when it has never been used","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"lastUsedAddress":{"name":"lastUsedAddress","type":"\u0007","is_mandatory":true,"title":"Address within the entry that most recently authenticated, empty when it has never been used","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"requestCount":{"name":"requestCount","type":"\u0005","is_mandatory":true,"title":"Number of requests Atlas has seen from this entry","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas API access list entry","desc":"A single source address that a programmatic credential (an API key or a service account) may authenticate from, keyed by the CIDR block or address it grants. A credential with no entries is usable from anywhere on the internet, so an empty access list is the condition to audit for, and the organization setting apiAccessListRequired reports whether Atlas enforces that an entry exists. Covers the granted CIDR block or single address, when the entry was created, and how it has been used: the number of requests seen from it, the last time it was used, and the address that used it. An entry that has never been used reports a null lastUsed, which identifies stale allowances that can be withdrawn.","private":true,"min_provider_version":"13.2.1","defaults":"cidrBlock ipAddress lastUsed","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.apiKey":{"id":"mongodbatlas.apiKey","name":"mongodbatlas.apiKey","fields":{"accessList":{"name":"accessList","type":"\u0019\u001bmongodbatlas.apiAccessListEntry","title":"API access list entries restricting where the key may be used from, empty when the key is usable from any address","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the key","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"API key id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"publicKey":{"name":"publicKey","type":"\u0007","is_mandatory":true,"title":"Public key (the non-secret half of the key pair)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roleAssignment":{"name":"roleAssignment","type":"\u001bmongodbatlas.apiKey.roleAssignment","title":"MongoDB Atlas API key role assignment","desc":"A single role granted to a programmatic API key, either at the organization level or scoped to one project. Covers the role name, whether the grant is organization-level, and the project a project-scoped grant applies to.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"roleAssignments":{"name":"roleAssignments","type":"\u0019\u001bmongodbatlas.apiKey.roleAssignment","title":"Role assignments granted to the key at the organization or project level","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas programmatic API key","desc":"A programmatic API key in the organization, keyed by its public key. Covers the description and the roles the key is granted at the organization and project level. The private key is never exposed. Select a key by public key, for example `mongodbatlas.apiKeys.where(description == \"ci\")`.","min_provider_version":"13.0.0","defaults":"publicKey description","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.apiKey.roleAssignment":{"id":"mongodbatlas.apiKey.roleAssignment","name":"mongodbatlas.apiKey.roleAssignment","fields":{"orgLevel":{"name":"orgLevel","type":"\u0004","is_mandatory":true,"title":"Whether the role is granted at the organization level rather than a project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"project":{"name":"project","type":"\u001bmongodbatlas.project","title":"Project the role applies to, null for an organization-level role","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"Role granted (such as ORG_OWNER or GROUP_READ_ONLY)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas API key role assignment","desc":"A single role granted to a programmatic API key, either at the organization level or scoped to one project. Covers the role name, whether the grant is organization-level, and the project a project-scoped grant applies to.","private":true,"min_provider_version":"13.0.1","defaults":"roleName","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.auditConfig":{"id":"mongodbatlas.auditConfig","name":"mongodbatlas.auditConfig","fields":{"auditAuthorizationSuccess":{"name":"auditAuthorizationSuccess","type":"\u0004","is_mandatory":true,"title":"Whether successful authorization events are audited in addition to failures","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"auditFilter":{"name":"auditFilter","type":"\u0007","is_mandatory":true,"title":"JSON audit filter selecting which events are recorded","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"configurationType":{"name":"configurationType","type":"\u0007","is_mandatory":true,"title":"How the audit filter was configured (NONE, FILTER_BUILDER, or FILTER_JSON)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether database auditing is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas database auditing configuration","desc":"The database auditing settings for the project. Covers whether auditing is enabled, whether authorization successes are audited (not just failures), the audit filter, and how the filter was configured.","min_provider_version":"13.0.0","defaults":"enabled auditAuthorizationSuccess","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.backupComplianceConfig":{"id":"mongodbatlas.backupComplianceConfig","name":"mongodbatlas.backupComplianceConfig","fields":{"authorizedEmail":{"name":"authorizedEmail","type":"\u0007","is_mandatory":true,"title":"Email address of the security contact authorized to change the policy","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"copyProtectionEnabled":{"name":"copyProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether snapshots are prevented from being copied to other projects","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"encryptionAtRestEnabled":{"name":"encryptionAtRestEnabled","type":"\u0004","is_mandatory":true,"title":"Whether encryption at rest is required for backups","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"onDemandPolicyItem":{"name":"onDemandPolicyItem","type":"\n","is_mandatory":true,"title":"On-demand backup retention rule, with frequencyType, retentionUnit, and retentionValue","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"pitEnabled":{"name":"pitEnabled","type":"\u0004","is_mandatory":true,"title":"Whether continuous point-in-time recovery is required","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"restoreWindowDays":{"name":"restoreWindowDays","type":"\u0005","is_mandatory":true,"title":"Minimum number of days backups are retained for point-in-time restore","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"scheduledPolicyItems":{"name":"scheduledPolicyItems","type":"\u0019\n","is_mandatory":true,"title":"Scheduled backup retention rules, each with frequencyType, frequencyInterval, retentionUnit, and retentionValue","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Enablement state of the Backup Compliance Policy (such as ACTIVE)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas Backup Compliance Policy","desc":"The Backup Compliance Policy for the project, the anti-ransomware immutability guardrail that prevents backups from being modified or deleted before their retention period expires. Covers whether copy protection and encryption at rest are enforced, whether point-in-time recovery is required, the restore window, the authorized security contact, the enablement state, and the on-demand and scheduled retention policy items. Present only when a Backup Compliance Policy has been configured, and null otherwise.","min_provider_version":"13.0.1","defaults":"state pitEnabled copyProtectionEnabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.backupScheduleConfig":{"id":"mongodbatlas.backupScheduleConfig","name":"mongodbatlas.backupScheduleConfig","fields":{"autoExportEnabled":{"name":"autoExportEnabled","type":"\u0004","is_mandatory":true,"title":"Whether snapshots are automatically exported to cloud storage","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"copySettings":{"name":"copySettings","type":"\u0019\n","is_mandatory":true,"title":"Cross-region snapshot copy settings","desc":"Each entry carries cloudProvider, regionName, zoneId, shouldCopyOplogs, and frequencies (the snapshot frequencies copied to that region). An empty list means snapshots exist in a single region only.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"exportBucket":{"name":"exportBucket","type":"\u001bmongodbatlas.snapshotExportBucket","title":"Bucket snapshots are automatically exported to, null when automatic export is off","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"exportFrequencyType":{"name":"exportFrequencyType","type":"\u0007","is_mandatory":true,"title":"Frequency snapshots are automatically exported at, null when automatic export is off","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"extraRetentionSettings":{"name":"extraRetentionSettings","type":"\u0019\n","is_mandatory":true,"title":"Extra retention settings that override the base retention","desc":"Each entry carries frequencyType and retentionDays.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"nextSnapshot":{"name":"nextSnapshot","type":"\t","is_mandatory":true,"title":"Time the next scheduled snapshot is taken","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"policyItems":{"name":"policyItems","type":"\u0019\n","is_mandatory":true,"title":"Retention policy items","desc":"Each entry carries frequencyType (hourly, daily, weekly, monthly, or yearly), frequencyInterval, retentionUnit (days, weeks, months, or years), and retentionValue. An empty list means no snapshots are retained on a schedule.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"referenceHourOfDay":{"name":"referenceHourOfDay","type":"\u0005","is_mandatory":true,"title":"Hour of the day in UTC that scheduled snapshots are taken at","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"referenceMinuteOfHour":{"name":"referenceMinuteOfHour","type":"\u0005","is_mandatory":true,"title":"Minute of the hour that scheduled snapshots are taken at","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"restoreWindowDays":{"name":"restoreWindowDays","type":"\u0005","is_mandatory":true,"title":"Days of continuous point-in-time restore coverage retained","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"useOrgAndGroupNamesInExportPrefix":{"name":"useOrgAndGroupNamesInExportPrefix","type":"\u0004","is_mandatory":true,"title":"Whether the export path is prefixed with the organization and project names","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"Cloud backup schedule for a cluster","desc":"The snapshot schedule and retention policy in effect for one cluster, which governs how often snapshots are taken, how long each is kept, how far back point-in-time restores reach, and whether snapshots are copied to other regions or exported to cloud storage. The cluster backupEnabled field only reports that backups run at all, so the retention policy items here are what a recovery-objective audit actually needs. Null when the cluster has cloud backup disabled, which is the case for Flex and shared tier deployments.","private":true,"min_provider_version":"13.1.4","defaults":"referenceHourOfDay restoreWindowDays","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.cloudProviderAccessRole":{"id":"mongodbatlas.cloudProviderAccessRole","name":"mongodbatlas.cloudProviderAccessRole","fields":{"atlasAWSAccountArn":{"name":"atlasAWSAccountArn","type":"\u0007","is_mandatory":true,"title":"ARN of the Atlas AWS account authorized to assume the role","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"authorizedDate":{"name":"authorizedDate","type":"\t","is_mandatory":true,"title":"Time the role was authorized, null when not yet authorized","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"azureAtlasAppId":{"name":"azureAtlasAppId","type":"\u0007","is_mandatory":true,"title":"Azure service principal application id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"azureTenantId":{"name":"azureTenantId","type":"\u0007","is_mandatory":true,"title":"Azure tenant id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"gcpServiceAccount":{"name":"gcpServiceAccount","type":"\u0007","is_mandatory":true,"title":"GCP service account email Atlas uses","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"iamAssumedRoleArn":{"name":"iamAssumedRoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS IAM role Atlas assumes","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"providerName":{"name":"providerName","type":"\u0007","is_mandatory":true,"title":"Cloud provider (AWS, AZURE, or GCP)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas cloud provider access role","desc":"A cloud provider identity (an AWS IAM role, Azure service principal, or GCP service account) that Atlas assumes to access customer cloud resources such as customer-managed encryption keys, keyed by roleId. Covers the provider, the assumed identity, and when it was authorized.","min_provider_version":"13.0.0","defaults":"providerName iamAssumedRoleArn","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.cluster":{"id":"mongodbatlas.cluster","name":"mongodbatlas.cluster","fields":{"advancedConfiguration":{"name":"advancedConfiguration","type":"\u001bmongodbatlas.clusterAdvancedConfig","title":"Advanced configuration in effect for the cluster","desc":"The process-level settings that the cluster listing does not carry, including whether server-side JavaScript execution is allowed, whether queries requiring a collection scan are refused, the cipher suites the cluster actually offers, the oplog retention window, and the default write concern.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"backupEnabled":{"name":"backupEnabled","type":"\u0004","is_mandatory":true,"title":"Whether cloud backup is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"backupSchedule":{"name":"backupSchedule","type":"\u001bmongodbatlas.backupScheduleConfig","title":"Cloud backup schedule and retention policy, null when cloud backup is disabled","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"biConnectorEnabled":{"name":"biConnectorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the BI Connector for Atlas is enabled","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"biConnectorReadPreference":{"name":"biConnectorReadPreference","type":"\u0007","is_mandatory":true,"title":"Nodes the BI Connector reads from (PRIMARY, SECONDARY, or ANALYTICS)","desc":"Atlas reports the configured preference whether or not the BI Connector is enabled, so read biConnectorEnabled to tell whether it is in effect.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"clusterType":{"name":"clusterType","type":"\u0007","is_mandatory":true,"title":"Cluster topology (REPLICASET, SHARDED, or GEOSHARDED)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"configServerManagementMode":{"name":"configServerManagementMode","type":"\u0007","is_mandatory":true,"title":"Config server management for a sharded cluster (ATLAS_MANAGED or FIXED_TO_DEDICATED), null for a replica set","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"configServerType":{"name":"configServerType","type":"\u0007","is_mandatory":true,"title":"Config server type in use for a sharded cluster (DEDICATED or EMBEDDED), null for a replica set","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"Time the cluster was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"diskWarmingMode":{"name":"diskWarmingMode","type":"\u0007","is_mandatory":true,"title":"When a restored node starts serving reads (FULLY_WARMED or VISIBLE_EARLIER), null when Atlas has not set one","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"employeeAccessGrantExpiration":{"name":"employeeAccessGrantExpiration","type":"\t","is_mandatory":true,"title":"Time the MongoDB employee access grant expires, null when no grant is active","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"employeeAccessGrantType":{"name":"employeeAccessGrantType","type":"\u0007","is_mandatory":true,"title":"Level of MongoDB employee access granted to the cluster, null when no grant is active","desc":"One of CLUSTER_DATABASE_LOGS, CLUSTER_INFRASTRUCTURE, or CLUSTER_INFRASTRUCTURE_AND_APP_SERVICES_SYNC_DATA. A non-null value means MongoDB support staff currently hold the named level of access to the cluster, which the organization-wide restrictEmployeeAccess setting governs.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"encryptionAtRestProvider":{"name":"encryptionAtRestProvider","type":"\u0007","is_mandatory":true,"title":"Encryption-at-rest provider (NONE, AWS, AZURE, or GCP)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"featureCompatibilityVersion":{"name":"featureCompatibilityVersion","type":"\u0007","is_mandatory":true,"title":"Feature compatibility version in effect for the cluster","desc":"The version whose features the cluster accepts, which lags the running MongoDB version while an upgrade is being validated. Pinning it to an older version holds back new features, and only a pinned version carries a featureCompatibilityVersionExpirationDate.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"featureCompatibilityVersionExpirationDate":{"name":"featureCompatibilityVersionExpirationDate","type":"\t","is_mandatory":true,"title":"Time the pinned feature compatibility version expires, null when the version is not pinned","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"globalClusterSelfManagedSharding":{"name":"globalClusterSelfManagedSharding","type":"\u0004","is_mandatory":true,"title":"Whether sharding for a global cluster is self-managed rather than managed by Atlas","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cluster id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"minimumEnabledTlsProtocol":{"name":"minimumEnabledTlsProtocol","type":"\u0007","is_mandatory":true,"title":"Minimum enabled TLS protocol (such as TLS1_2)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongoDBMajorVersion":{"name":"mongoDBMajorVersion","type":"\u0007","is_mandatory":true,"title":"Configured MongoDB major version","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongoDBVersion":{"name":"mongoDBVersion","type":"\u0007","is_mandatory":true,"title":"Running MongoDB version","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cluster name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"onlineArchives":{"name":"onlineArchives","type":"\u0019\u001bmongodbatlas.onlineArchive","title":"Online archives defined on the cluster","desc":"Archived documents leave the cluster for a separate store with its own retention rule and query path, which the cluster backup, encryption, and network settings do not cover.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"paused":{"name":"paused","type":"\u0004","is_mandatory":true,"title":"Whether the cluster is paused","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"pitEnabled":{"name":"pitEnabled","type":"\u0004","is_mandatory":true,"title":"Whether continuous point-in-time recovery is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"privateEndpointConnectionStrings":{"name":"privateEndpointConnectionStrings","type":"\u0019\n","is_mandatory":true,"title":"Private endpoint connection strings","desc":"Each entry carries type (the kind of private endpoint the provider offers), connectionString, srvConnectionString, and the endpoints backing it with their endpointId, providerName, and region. An empty list means no private endpoint reaches this cluster.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"privateSrvConnectionString":{"name":"privateSrvConnectionString","type":"\u0007","is_mandatory":true,"title":"SRV connection string for clients reaching the cluster over a peered network, null when no peering reaches it","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"redactClientLogData":{"name":"redactClientLogData","type":"\u0004","is_mandatory":true,"title":"Whether client log data is redacted","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"regionConfigs":{"name":"regionConfigs","type":"\u0019\n","is_mandatory":true,"title":"Per-region configuration","desc":"Each entry carries providerName, regionName, instanceSize, nodeCount, diskSizeGB, and priority. A shared tier deployment reports a providerName of TENANT and adds backingProviderName naming the cloud that actually hosts it.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"replicaSetScalingStrategy":{"name":"replicaSetScalingStrategy","type":"\u0007","is_mandatory":true,"title":"Order replica set nodes are scaled in (SEQUENTIAL, WORKLOAD_TYPE, or NODE_TYPE), null when Atlas has not set one","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"retainBackups":{"name":"retainBackups","type":"\u0004","is_mandatory":true,"title":"Whether snapshots survive the cluster being deleted","desc":"When false, deleting the cluster destroys its backups with it, so a deletion leaves nothing to restore from. Independent of backupEnabled, which only reports that backups are being taken.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"rootCertType":{"name":"rootCertType","type":"\u0007","is_mandatory":true,"title":"Root CA certificate type","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"searchIndexes":{"name":"searchIndexes","type":"\u0019\u001bmongodbatlas.searchIndex","title":"Atlas Search and Atlas Vector Search indexes on the cluster","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"standardSrvConnectionString":{"name":"standardSrvConnectionString","type":"\u0007","is_mandatory":true,"title":"Standard SRV connection string clients use over the public internet, null when the cluster has no public endpoint","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"stateName":{"name":"stateName","type":"\u0007","is_mandatory":true,"title":"Current state (such as IDLE or CREATING)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags applied to the cluster","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"terminationProtectionEnabled":{"name":"terminationProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether termination protection is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"tlsCipherConfigMode":{"name":"tlsCipherConfigMode","type":"\u0007","is_mandatory":true,"title":"TLS cipher configuration mode (DEFAULT or CUSTOM)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"versionReleaseSystem":{"name":"versionReleaseSystem","type":"\u0007","is_mandatory":true,"title":"Version release track (LTS or CONTINUOUS)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas cluster","desc":"A database cluster (deployment) in the project, keyed by name. Covers the MongoDB version and release track, cluster topology, backup and point-in-time-recovery state, encryption-at-rest provider, the minimum enabled TLS protocol, client-log redaction, termination protection, and the per-region provider and instance sizing. The connection strings report how clients reach the cluster, over the public internet or through a peered network or private endpoint, and employeeAccessGrantType reports whether MongoDB support staff currently hold access to it. Flex tier deployments come from a separate endpoint and appear under flexClusters instead. Select a cluster by name, for example `mongodbatlas.clusters.where(name == \"prod-0\")`.","min_provider_version":"13.0.0","defaults":"name mongoDBMajorVersion encryptionAtRestProvider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.clusterAdvancedConfig":{"id":"mongodbatlas.clusterAdvancedConfig","name":"mongodbatlas.clusterAdvancedConfig","fields":{"changeStreamOptionsPreAndPostImagesExpireAfterSeconds":{"name":"changeStreamOptionsPreAndPostImagesExpireAfterSeconds","type":"\u0005","is_mandatory":true,"title":"Minimum retention in seconds for change stream pre-images and post-images","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"chunkMigrationConcurrency":{"name":"chunkMigrationConcurrency","type":"\u0005","is_mandatory":true,"title":"Number of threads used per shard for chunk migration","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"customOpensslCipherConfigTls12":{"name":"customOpensslCipherConfigTls12","type":"\u0019\u0007","is_mandatory":true,"title":"Cipher suites offered for TLS 1.2, empty unless tlsCipherConfigMode is CUSTOM","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"customOpensslCipherConfigTls13":{"name":"customOpensslCipherConfigTls13","type":"\u0019\u0007","is_mandatory":true,"title":"Cipher suites offered for TLS 1.3, empty unless tlsCipherConfigMode is CUSTOM","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"defaultMaxTimeMS":{"name":"defaultMaxTimeMS","type":"\u0005","is_mandatory":true,"title":"Default time limit in milliseconds for an individual read operation","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"defaultWriteConcern":{"name":"defaultWriteConcern","type":"\u0007","is_mandatory":true,"title":"Write acknowledgement applied when a driver names none","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"javascriptEnabled":{"name":"javascriptEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the cluster executes operations that run server-side JavaScript","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"minimumEnabledTlsProtocol":{"name":"minimumEnabledTlsProtocol","type":"\u0007","is_mandatory":true,"title":"Minimum TLS version the cluster accepts for incoming connections","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"noTableScan":{"name":"noTableScan","type":"\u0004","is_mandatory":true,"title":"Whether the cluster refuses any query that would require a collection scan","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"oplogMinRetentionHours":{"name":"oplogMinRetentionHours","type":"\u0006","is_mandatory":true,"title":"Minimum oplog retention in hours, null when Atlas calculates the window","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"oplogSizeMB":{"name":"oplogSizeMB","type":"\u0005","is_mandatory":true,"title":"Oplog storage limit in megabytes, null when Atlas calculates the size","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"queryStatsLogVerbosity":{"name":"queryStatsLogVerbosity","type":"\u0005","is_mandatory":true,"title":"Query statistics log verbosity","desc":"1 disables query-shape logging and 3 enables it, which writes redacted and anonymized query shapes into the cluster logs.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"sampleRefreshIntervalBIConnector":{"name":"sampleRefreshIntervalBIConnector","type":"\u0005","is_mandatory":true,"title":"Interval in seconds at which the BI Connector re-samples data","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"sampleSizeBIConnector":{"name":"sampleSizeBIConnector","type":"\u0005","is_mandatory":true,"title":"Number of documents per database sampled when the BI Connector builds its schema","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"tlsCipherConfigMode":{"name":"tlsCipherConfigMode","type":"\u0007","is_mandatory":true,"title":"TLS cipher suite configuration mode (DEFAULT or CUSTOM)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"transactionLifetimeLimitSeconds":{"name":"transactionLifetimeLimitSeconds","type":"\u0005","is_mandatory":true,"title":"Lifetime in seconds after which a multi-document transaction is aborted","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas cluster advanced configuration","desc":"The process-level settings in effect for one cluster, which the cluster listing does not carry. Covers whether the cluster executes server-side JavaScript, whether it refuses queries that require a collection scan, the minimum TLS version and the cipher suites actually offered when the cipher mode is CUSTOM, the oplog retention window that bounds how far a point-in-time restore reaches, the default write concern applied when a driver names none, and the query-plan logging verbosity. A setting the cluster leaves at the Atlas default reads null rather than a value.","private":true,"min_provider_version":"13.4.1","defaults":"javascriptEnabled noTableScan minimumEnabledTlsProtocol","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.connectedOrgConfig":{"id":"mongodbatlas.connectedOrgConfig","name":"mongodbatlas.connectedOrgConfig","fields":{"conflictingUsernames":{"name":"conflictingUsernames","type":"\u0019\u0007","is_mandatory":true,"title":"Login names of users that exist both inside and outside the federation","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"dataAccessIdentityProviders":{"name":"dataAccessIdentityProviders","type":"\u0019\u001bmongodbatlas.identityProvider","title":"Identity providers authorized to grant database access","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"domainAllowList":{"name":"domainAllowList","type":"\u0019\u0007","is_mandatory":true,"title":"Domains the organization has claimed for federated sign-in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"domainRestrictionEnabled":{"name":"domainRestrictionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether sign-in is restricted to users in the allowed domains","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"identityProvider":{"name":"identityProvider","type":"\u001bmongodbatlas.identityProvider","title":"Identity provider that authenticates sign-in for the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"instantUserProvisioningDisabled":{"name":"instantUserProvisioningDisabled","type":"\u0004","is_mandatory":true,"title":"Whether just-in-time provisioning of new users is disabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"orgId":{"name":"orgId","type":"\u0007","is_mandatory":true,"title":"Organization id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"postAuthRoleGrants":{"name":"postAuthRoleGrants","type":"\u0019\u0007","is_mandatory":true,"title":"Roles granted to every federated user on sign-in, independent of any role mapping","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roleMappings":{"name":"roleMappings","type":"\u0019\u001bmongodbatlas.roleMapping","title":"Mappings from identity provider group to Atlas roles","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas connected organization","desc":"The link between one organization and an identity federation, keyed by organization id. Covers whether sign-in is restricted to the federated domains, which domains those are, the roles every federated user receives on sign-in regardless of any mapping, whether just-in-time user provisioning is switched off, the identity provider that authenticates sign-in, the providers authorized for database access, and the mappings from provider group to Atlas role. postAuthRoleGrants is a blanket grant, so a privileged role listed there reaches every user the provider authenticates.","min_provider_version":"13.4.1","defaults":"orgId domainRestrictionEnabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.customDatabaseRole":{"id":"mongodbatlas.customDatabaseRole","name":"mongodbatlas.customDatabaseRole","fields":{"actions":{"name":"actions","type":"\u0019\n","is_mandatory":true,"title":"Privilege actions the role grants, each with its action name and the resources (cluster, database, collection) it applies to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"inheritedRoles":{"name":"inheritedRoles","type":"\u0019\n","is_mandatory":true,"title":"Roles this custom role inherits, each with its role name and database","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roleName":{"name":"roleName","type":"\u0007","is_mandatory":true,"title":"Role name","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas custom database role","desc":"A user-defined database role in the project, keyed by role name. Covers the individual privilege actions the role grants (each with the cluster, database, and collection resources it applies to) and the built-in or custom roles it inherits. Auditing custom roles surfaces over-privileged or privilege-escalating grants beyond the built-in roles. Select a role by name, for example `mongodbatlas.customDatabaseRoles.where(roleName == \"appReadWrite\")`.","min_provider_version":"13.0.1","defaults":"roleName","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.dataFederation":{"id":"mongodbatlas.dataFederation","name":"mongodbatlas.dataFederation","fields":{"awsTestS3Bucket":{"name":"awsTestS3Bucket","type":"\u0007","is_mandatory":true,"title":"Bucket Atlas writes to when it validates the AWS role, empty for other providers","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"cloudProvider":{"name":"cloudProvider","type":"\u0007","is_mandatory":true,"title":"Cloud provider queries are processed in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"cloudProviderAccessRole":{"name":"cloudProviderAccessRole","type":"\u001bmongodbatlas.cloudProviderAccessRole","title":"Cloud provider access role the instance assumes to read its stores","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"hostnames":{"name":"hostnames","type":"\u0019\u0007","is_mandatory":true,"title":"Hostnames clients connect to the instance on","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tenant name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"privateEndpointHostnames":{"name":"privateEndpointHostnames","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Private endpoints that reach the instance, keyed by hostname","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region queries are processed in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state (such as ACTIVE or DELETED)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"store":{"name":"store","type":"\u001bmongodbatlas.dataFederation.store","title":"MongoDB Atlas federated database store","desc":"One backing store a federated database instance reads, keyed by store name. Covers the provider it lives on, the bucket or container and prefix it reads, the region, whether the bucket is treated as public so Atlas reads it without credentials, and whether TLS verification is waived when reaching an HTTP store. A public store or one reached with allowInsecure set is data leaving the project boundary without the controls the rest of it has.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"stores":{"name":"stores","type":"\u0019\u001bmongodbatlas.dataFederation.store","title":"Stores the instance reads from","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas federated database instance","desc":"A federated database instance in the project, keyed by tenant name. It serves queries over data that lives outside the cluster, in customer cloud storage and in other Atlas clusters, so the stores it reads and the cloud provider access role it assumes describe a data path the cluster and network settings do not. Covers the tenant name and state, the hostnames clients connect to, the region queries are processed in, the private endpoints that reach it, and the store definitions behind it. Select an instance by name, for example `mongodbatlas.dataFederations.where(name == \"analytics\")`.","min_provider_version":"13.4.1","defaults":"name state cloudProvider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.dataFederation.store":{"id":"mongodbatlas.dataFederation.store","name":"mongodbatlas.dataFederation.store","fields":{"additionalStorageClasses":{"name":"additionalStorageClasses","type":"\u0019\u0007","is_mandatory":true,"title":"Additional storage classes the store reads from","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"allowInsecure":{"name":"allowInsecure","type":"\u0004","is_mandatory":true,"title":"Whether TLS verification is waived when reaching an HTTP store","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"bucket":{"name":"bucket","type":"\u0007","is_mandatory":true,"title":"Bucket the store reads, for an object storage provider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"clusterName":{"name":"clusterName","type":"\u0007","is_mandatory":true,"title":"Cluster an Atlas store reads from","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"containerName":{"name":"containerName","type":"\u0007","is_mandatory":true,"title":"Container the store reads, for an Azure store","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"defaultFormat":{"name":"defaultFormat","type":"\u0007","is_mandatory":true,"title":"Format assumed for a file whose extension does not name one","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"delimiter":{"name":"delimiter","type":"\u0007","is_mandatory":true,"title":"Character separating the path segments Atlas maps to collection names","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"includeTags":{"name":"includeTags","type":"\u0004","is_mandatory":true,"title":"Whether object tags are read alongside the objects","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Store name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"prefix":{"name":"prefix","type":"\u0007","is_mandatory":true,"title":"Prefix within the bucket or container that the store is limited to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"Provider the store lives on (such as s3, azure, gcs, atlas, http, or dls)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"public":{"name":"public","type":"\u0004","is_mandatory":true,"title":"Whether the bucket is read as public, so Atlas reaches it without credentials","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region the store lives in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"serviceUrl":{"name":"serviceUrl","type":"\u0007","is_mandatory":true,"title":"Service URL an Azure store is reached through","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"urls":{"name":"urls","type":"\u0019\u0007","is_mandatory":true,"title":"URLs an HTTP store reads","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas federated database store","desc":"One backing store a federated database instance reads, keyed by store name. Covers the provider it lives on, the bucket or container and prefix it reads, the region, whether the bucket is treated as public so Atlas reads it without credentials, and whether TLS verification is waived when reaching an HTTP store. A public store or one reached with allowInsecure set is data leaving the project boundary without the controls the rest of it has.","private":true,"min_provider_version":"13.4.1","defaults":"name provider bucket","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.databaseUser":{"id":"mongodbatlas.databaseUser","name":"mongodbatlas.databaseUser","fields":{"awsIAMType":{"name":"awsIAMType","type":"\u0007","is_mandatory":true,"title":"AWS IAM authentication type (NONE, USER, or ROLE)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"certificates":{"name":"certificates","type":"\u0019\u001bmongodbatlas.databaseUserCertificate","title":"Managed X.509 certificates issued to the user","desc":"Empty for a user that does not authenticate by certificate. Each entry carries the certificate subject and the notAfter expiry, which is what x509Type on its own cannot report.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Authentication database (admin for SCRAM, $external for X.509/IAM/LDAP/OIDC)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"deleteAfterDate":{"name":"deleteAfterDate","type":"\t","is_mandatory":true,"title":"Time after which the user is automatically deleted, null when permanent","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the user","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Composite id (authentication database and username)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"labels":{"name":"labels","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Labels attached to the user, as key/value pairs","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapAuthType":{"name":"ldapAuthType","type":"\u0007","is_mandatory":true,"title":"LDAP authentication type (NONE, USER, or GROUP)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"oidcAuthType":{"name":"oidcAuthType","type":"\u0007","is_mandatory":true,"title":"OIDC authentication type (NONE, IDP_GROUP, or USER)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\n","is_mandatory":true,"title":"Roles granted to the user, each with roleName, databaseName, and optional collectionName","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"scopedClusters":{"name":"scopedClusters","type":"\u0019\u001bmongodbatlas.cluster","title":"Clusters the user is scoped to, empty when the user may access all clusters in the project","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"scopes":{"name":"scopes","type":"\u0019\n","is_mandatory":true,"title":"Scopes limiting the clusters or data lakes the user may access, each with name and type","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"x509Type":{"name":"x509Type","type":"\u0007","is_mandatory":true,"title":"X.509 authentication type (NONE, MANAGED, or CUSTOMER)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas database user","desc":"A database user in the project, keyed by the username and authentication database. Covers the authentication mechanism (SCRAM, X.509, AWS IAM, LDAP, or OIDC), the granted roles, the scopes limiting which clusters the user may access, and any automatic deletion time. The password is never exposed. Select a user by username, for example `mongodbatlas.databaseUsers.where(username == \"app\")`.","min_provider_version":"13.0.0","defaults":"username databaseName","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.databaseUserCertificate":{"id":"mongodbatlas.databaseUserCertificate","name":"mongodbatlas.databaseUserCertificate","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the certificate was issued","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Certificate id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"notAfter":{"name":"notAfter","type":"\t","is_mandatory":true,"title":"Time the certificate expires","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Distinguished name the certificate authenticates as","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas managed X.509 certificate","desc":"One certificate Atlas issued to a database user for X.509 authentication, keyed by certificate id. Covers the subject the certificate authenticates as, when it was issued, and when it expires. A user whose x509Type is MANAGED but whose certificates have all passed their notAfter can no longer authenticate, and one that expires soon is a scheduled outage.","private":true,"min_provider_version":"13.4.1","defaults":"subject notAfter","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.encryptionConfig":{"id":"mongodbatlas.encryptionConfig","name":"mongodbatlas.encryptionConfig","fields":{"awsKmsEnabled":{"name":"awsKmsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether AWS KMS customer-key encryption at rest is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"awsKmsValid":{"name":"awsKmsValid","type":"\u0004","is_mandatory":true,"title":"Whether the AWS KMS configuration is valid","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"azureKeyVaultEnabled":{"name":"azureKeyVaultEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Azure Key Vault customer-key encryption at rest is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"azureKeyVaultValid":{"name":"azureKeyVaultValid","type":"\u0004","is_mandatory":true,"title":"Whether the Azure Key Vault configuration is valid","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"enabledForSearchNodes":{"name":"enabledForSearchNodes","type":"\u0004","is_mandatory":true,"title":"Whether encryption at rest is enabled for search nodes","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"googleCloudKmsEnabled":{"name":"googleCloudKmsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Google Cloud KMS customer-key encryption at rest is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"googleCloudKmsValid":{"name":"googleCloudKmsValid","type":"\u0004","is_mandatory":true,"title":"Whether the Google Cloud KMS configuration is valid","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas encryption-at-rest configuration","desc":"The customer-managed encryption-at-rest settings for the project. Covers whether encryption at rest with a customer key is enabled for each cloud provider (AWS KMS, Azure Key Vault, Google Cloud KMS) and for search nodes. Key material is never exposed.","min_provider_version":"13.0.0","defaults":"awsKmsEnabled azureKeyVaultEnabled googleCloudKmsEnabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.federationConfig":{"id":"mongodbatlas.federationConfig","name":"mongodbatlas.federationConfig","fields":{"connectedOrgConfigs":{"name":"connectedOrgConfigs","type":"\u0019\u001bmongodbatlas.connectedOrgConfig","title":"Organizations connected to the federation","desc":"The connection between an organization and the federation, carrying the domain restriction, the roles every federated user receives on sign-in, and the mappings from identity provider group to Atlas role.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"federatedDomains":{"name":"federatedDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Domains the organization has federated to its identity provider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"hasRoleMappings":{"name":"hasRoleMappings","type":"\u0004","is_mandatory":true,"title":"Whether the organization has role mappings configured","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Federation settings id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"identityProvider":{"name":"identityProvider","type":"\u001bmongodbatlas.identityProvider","title":"Identity provider connected to the organization","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"identityProviderStatus":{"name":"identityProviderStatus","type":"\u0007","is_mandatory":true,"title":"Status of the connected identity provider (ACTIVE or INACTIVE)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"identityProviders":{"name":"identityProviders","type":"\u0019\u001bmongodbatlas.identityProvider","title":"Identity providers linked to the federation","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas identity federation settings","desc":"Organization-level identity federation configuration. Covers the connected identity provider and its status, whether role mappings are configured, the domains the organization has federated, and the identity providers linked to the federation. Present only when the organization has federation configured, and null otherwise.","min_provider_version":"13.0.1","defaults":"id identityProviderStatus","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.flexCluster":{"id":"mongodbatlas.flexCluster","name":"mongodbatlas.flexCluster","fields":{"backingProviderName":{"name":"backingProviderName","type":"\u0007","is_mandatory":true,"title":"Cloud provider the deployment runs on (AWS, AZURE, or GCP)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"backupEnabled":{"name":"backupEnabled","type":"\u0004","is_mandatory":true,"title":"Whether cloud backup is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"clusterType":{"name":"clusterType","type":"\u0007","is_mandatory":true,"title":"Cluster topology, always REPLICASET for a Flex deployment","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"Time the deployment was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"diskSizeGB":{"name":"diskSizeGB","type":"\u0006","is_mandatory":true,"title":"Storage capacity in GB","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cluster id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongoDBVersion":{"name":"mongoDBVersion","type":"\u0007","is_mandatory":true,"title":"Running MongoDB version","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cluster name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"providerName":{"name":"providerName","type":"\u0007","is_mandatory":true,"title":"Provider name, always FLEX for a Flex deployment","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"regionName":{"name":"regionName","type":"\u0007","is_mandatory":true,"title":"Region the deployment runs in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"standardSrvConnectionString":{"name":"standardSrvConnectionString","type":"\u0007","is_mandatory":true,"title":"Standard SRV connection string clients use to reach the deployment, null while it is still being created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"stateName":{"name":"stateName","type":"\u0007","is_mandatory":true,"title":"Current state (such as IDLE, CREATING, UPDATING, or DELETING)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags applied to the deployment","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"terminationProtectionEnabled":{"name":"terminationProtectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether termination protection is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"versionReleaseSystem":{"name":"versionReleaseSystem","type":"\u0007","is_mandatory":true,"title":"Version release track (LTS or CONTINUOUS)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas Flex cluster","desc":"A Flex tier database deployment in the project, keyed by name. Flex clusters come from a separate endpoint than dedicated and shared tier deployments, so they do not appear under clusters and a project holding only Flex deployments looks empty there. Covers the running MongoDB version and release track, the cloud provider and region backing the deployment, storage capacity, backup state, termination protection, and the resource tags applied. Select a Flex cluster by name, for example `mongodbatlas.flexClusters.where(name == \"flex-0\")`.","min_provider_version":"13.1.4","defaults":"name backingProviderName regionName stateName","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.identityProvider":{"id":"mongodbatlas.identityProvider","name":"mongodbatlas.identityProvider","fields":{"associatedDomains":{"name":"associatedDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Domains associated with the identity provider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"authorizationType":{"name":"authorizationType","type":"\u0007","is_mandatory":true,"title":"OIDC authorization mode (GROUP for group membership or USER for user id)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"OIDC client id assigned to the application by the identity provider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the identity provider was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the identity provider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable name of the identity provider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"groupsClaim":{"name":"groupsClaim","type":"\u0007","is_mandatory":true,"title":"OIDC token claim that carries the identity provider group ids","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identity provider id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"idpType":{"name":"idpType","type":"\u0007","is_mandatory":true,"title":"Provider type (WORKFORCE or WORKLOAD)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"issuerUri":{"name":"issuerUri","type":"\u0007","is_mandatory":true,"title":"Issuer URI of the SAML assertion or OIDC discovery document","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol of the identity provider (SAML or OIDC)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"requestBinding":{"name":"requestBinding","type":"\u0007","is_mandatory":true,"title":"SAML authentication request binding (POST or REDIRECT)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"requestedScopes":{"name":"requestedScopes","type":"\u0019\u0007","is_mandatory":true,"title":"OIDC scopes requested from the authorization endpoint","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"responseSignatureAlgorithm":{"name":"responseSignatureAlgorithm","type":"\u0007","is_mandatory":true,"title":"SAML response signature algorithm","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ssoDebugEnabled":{"name":"ssoDebugEnabled","type":"\u0004","is_mandatory":true,"title":"Whether SAML SSO debug mode is enabled, which should be off in production","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ssoUrl":{"name":"ssoUrl","type":"\u0007","is_mandatory":true,"title":"SAML single sign-on URL","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the identity provider (ACTIVE or INACTIVE)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the identity provider was last updated","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"userClaim":{"name":"userClaim","type":"\u0007","is_mandatory":true,"title":"OIDC token claim that carries the user id","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas identity provider","desc":"A SAML or OIDC identity provider linked to the organization's federation, keyed by id. Covers the protocol and provider type, the activation status, the issuer and associated domains, and the protocol-specific settings that matter for sign-in security (SAML request binding, response signature algorithm, and SSO debug mode; OIDC authorization type, client id, and requested scopes). Read providers from the federation settings, for example `mongodbatlas.federationConfig.identityProviders.where(ssoDebugEnabled == true)`.","min_provider_version":"13.0.1","defaults":"displayName protocol status","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.maintenanceWindowConfig":{"id":"mongodbatlas.maintenanceWindowConfig","name":"mongodbatlas.maintenanceWindowConfig","fields":{"autoDeferOnceEnabled":{"name":"autoDeferOnceEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Atlas defers all maintenance windows for one week after they are enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"dayOfWeek":{"name":"dayOfWeek","type":"\u0005","is_mandatory":true,"title":"Day of the week the window starts on, 1 for Sunday through 7 for Saturday","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"hourOfDay":{"name":"hourOfDay","type":"\u0005","is_mandatory":true,"title":"Hour of the day the window starts at, on a 24-hour clock","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"numberOfDeferrals":{"name":"numberOfDeferrals","type":"\u0005","is_mandatory":true,"title":"Number of times the currently scheduled maintenance has been deferred","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"protectedHoursEndHourOfDay":{"name":"protectedHoursEndHourOfDay","type":"\u0005","is_mandatory":true,"title":"Hour of the day the protected period ends at, null when none is set","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"protectedHoursStartHourOfDay":{"name":"protectedHoursStartHourOfDay","type":"\u0005","is_mandatory":true,"title":"Hour of the day the protected period starts at, null when none is set","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"startAsap":{"name":"startAsap","type":"\u0004","is_mandatory":true,"title":"Whether Atlas starts the maintenance window as soon as it can","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"timeZoneId":{"name":"timeZoneId","type":"\u0007","is_mandatory":true,"title":"Time zone the window is expressed in","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas maintenance window","desc":"The weekly window in which Atlas applies maintenance to the project's clusters. Covers the day and hour it starts, the hours maintenance is kept out of, whether the window auto-defers on first use, and how many times the currently scheduled maintenance has been deferred. Repeated deferral is how a cluster stays on an unpatched build, and numberOfDeferrals is what makes that countable.","min_provider_version":"13.4.1","defaults":"dayOfWeek hourOfDay numberOfDeferrals","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.mcpConfiguration":{"id":"mongodbatlas.mcpConfiguration","name":"mongodbatlas.mcpConfiguration","fields":{"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"OAuth client id of the service account the MCP client authenticates as","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"egressClientId":{"name":"egressClientId","type":"\u0007","is_mandatory":true,"title":"OAuth client id of the egress service account MongoDB Atlas manages","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Configuration id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ipAccessList":{"name":"ipAccessList","type":"\u0019\u001bmongodbatlas.apiAccessListEntry","is_mandatory":true,"title":"Addresses the MCP client may connect from","desc":"Empty when the configuration carries no source restriction, which leaves the endpoint reachable from anywhere the Atlas API is, for anyone holding the service account credentials.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Human-readable name identifying the configuration","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles the configuration grants","desc":"Organization roles for an organization-scoped configuration and project roles for a project-scoped one. These are the permissions an MCP client acts with once it connects.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope the configuration is defined at, ORGANIZATION or PROJECT","desc":"An organization-scoped configuration grants organization roles and reaches every project beneath it; a project-scoped one is confined to its project.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"serviceAccount":{"name":"serviceAccount","type":"\u001bmongodbatlas.serviceAccount","title":"Service account the MCP client authenticates as","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas Remote MCP configuration","desc":"A configuration that exposes Atlas through the Remote MCP endpoint, which is how an MCP client such as an AI agent reads and acts on the deployment. Each configuration authenticates as a service account and carries the roles that account holds plus the addresses it may connect from, so it is a standing non-human path into the data that outlives any individual session. Reports the roles granted, the service account behind the configuration, and the source restriction, which is the control that keeps the endpoint from being reachable by anyone holding the credentials. Configurations exist at both organization and project scope and the scope field says which this one is. Keyed by id.","min_provider_version":"13.3.1","defaults":"name scope","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.metricIntegration":{"id":"mongodbatlas.metricIntegration","name":"mongodbatlas.metricIntegration","fields":{"aggregationTemporality":{"name":"aggregationTemporality","type":"\u0007","is_mandatory":true,"title":"Temporality the exported metrics are reported with","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"authType":{"name":"authType","type":"\u0007","is_mandatory":true,"title":"Authentication method used against the collector endpoint","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"endpointHost":{"name":"endpointHost","type":"\u0007","is_mandatory":true,"title":"Host of the collector endpoint","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"headerNames":{"name":"headerNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the HTTP headers sent with the export, the values of which Atlas redacts","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Metric integration id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"integrationType":{"name":"integrationType","type":"\u0007","is_mandatory":true,"title":"Protocol used to export (such as OTLP)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"metricSelection":{"name":"metricSelection","type":"\u0019\u0007","is_mandatory":true,"title":"Metric categories exported to the collector","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"providerType":{"name":"providerType","type":"\u0007","is_mandatory":true,"title":"Third-party service the collector belongs to","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas metric integration","desc":"One OpenTelemetry export destination on the project, keyed by integration id. Covers the protocol, the provider the collector belongs to, the authentication method used against it, the aggregation temporality, and which metric categories are exported. Header values are redacted by Atlas and only the header names are exposed, and the collector address is reduced to its host. This is a separate export path from the third-party service integrations, so both have to be read to see everywhere project telemetry goes.","min_provider_version":"13.4.1","defaults":"providerType integrationType endpointHost","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.networkAccessEntry":{"id":"mongodbatlas.networkAccessEntry","name":"mongodbatlas.networkAccessEntry","fields":{"awsSecurityGroup":{"name":"awsSecurityGroup","type":"\u0007","is_mandatory":true,"title":"AWS security group granted access","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"cidrBlock":{"name":"cidrBlock","type":"\u0007","is_mandatory":true,"title":"CIDR block granted access","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment describing the entry","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"deleteAfterDate":{"name":"deleteAfterDate","type":"\t","is_mandatory":true,"title":"Time after which the entry is automatically removed, null when permanent","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ipAddress":{"name":"ipAddress","type":"\u0007","is_mandatory":true,"title":"Single IP address granted access","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas project IP access list entry","desc":"A single entry in the project's IP access list, keyed by its CIDR block or IP address. Only clients matching an entry may reach the project's clusters. Covers the CIDR block or address, an optional AWS security group, and any automatic expiry. Select an entry by value, for example `mongodbatlas.ipAccessList.where(cidrBlock == \"10.0.0.0/24\")`.","min_provider_version":"13.0.0","defaults":"cidrBlock ipAddress comment","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.networkPeering":{"id":"mongodbatlas.networkPeering","name":"mongodbatlas.networkPeering","fields":{"awsAccountId":{"name":"awsAccountId","type":"\u0007","is_mandatory":true,"title":"AWS account id of the peered VPC","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"containerId":{"name":"containerId","type":"\u0007","is_mandatory":true,"title":"Id of the Atlas network container","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Peering connection id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"networkName":{"name":"networkName","type":"\u0007","is_mandatory":true,"title":"Peered GCP network name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"providerName":{"name":"providerName","type":"\u0007","is_mandatory":true,"title":"Cloud provider (AWS, AZURE, or GCP)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"routeTableCidrBlock":{"name":"routeTableCidrBlock","type":"\u0007","is_mandatory":true,"title":"CIDR block of the peered route table","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the peering connection","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"vnetName":{"name":"vnetName","type":"\u0007","is_mandatory":true,"title":"Peered Azure VNet name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"vpcId":{"name":"vpcId","type":"\u0007","is_mandatory":true,"title":"Peered AWS VPC id","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas network peering connection","desc":"A VPC or VNet peering connection between the project's Atlas network and a customer network, keyed by id. Covers the cloud provider, the peered network identifiers, and the connection status. Fields vary by provider.","min_provider_version":"13.0.0","defaults":"providerName status","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.onlineArchive":{"id":"mongodbatlas.onlineArchive","name":"mongodbatlas.onlineArchive","fields":{"collectionName":{"name":"collectionName","type":"\u0007","is_mandatory":true,"title":"Source collection","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"collectionType":{"name":"collectionType","type":"\u0007","is_mandatory":true,"title":"Source collection type (STANDARD or TIMESERIES)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"criteriaDateField":{"name":"criteriaDateField","type":"\u0007","is_mandatory":true,"title":"Document field holding the date that a DATE criteria compares","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"criteriaExpireAfterDays":{"name":"criteriaExpireAfterDays","type":"\u0005","is_mandatory":true,"title":"Age in days at which a DATE criteria archives a document","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"criteriaQuery":{"name":"criteriaQuery","type":"\u0007","is_mandatory":true,"title":"Query selecting the documents a CUSTOM criteria archives","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"criteriaType":{"name":"criteriaType","type":"\u0007","is_mandatory":true,"title":"How documents are selected for archiving (DATE or CUSTOM)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"dataProcessCloudProvider":{"name":"dataProcessCloudProvider","type":"\u0007","is_mandatory":true,"title":"Cloud provider the archive is processed in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"dataProcessRegion":{"name":"dataProcessRegion","type":"\u0007","is_mandatory":true,"title":"Region the archive is processed in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"dataSetName":{"name":"dataSetName","type":"\u0007","is_mandatory":true,"title":"Name of the archive's federated data set","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Source database","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"expireAfterDays":{"name":"expireAfterDays","type":"\u0005","is_mandatory":true,"title":"Age in days at which archived data is deleted, null when it is kept indefinitely","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Archive id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"partitionFields":{"name":"partitionFields","type":"\u0019\n","is_mandatory":true,"title":"Fields the archive is partitioned by, each with fieldName, fieldType, and order","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"paused":{"name":"paused","type":"\u0004","is_mandatory":true,"title":"Whether archiving is paused","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"scheduleType":{"name":"scheduleType","type":"\u0007","is_mandatory":true,"title":"Schedule the archiving runs on (DEFAULT, DAILY, WEEKLY, or MONTHLY)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state (such as ACTIVE, PAUSED, or DELETED)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas online archive","desc":"An archiving rule on one cluster collection, keyed by archive id. Documents matching the rule move out of the cluster into a separate managed store with its own retention and its own query endpoint, so the cluster's backup, encryption, and network settings stop applying to them. Covers the source database and collection, the archiving criteria and the schedule they run on, whether the rule is paused, the region the archive is processed in, and the expiry rule that deletes archived data.","min_provider_version":"13.4.1","defaults":"databaseName collectionName state","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.orgUser":{"id":"mongodbatlas.orgUser","name":"mongodbatlas.orgUser","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the user account was created","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"User id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"invitationCreatedAt":{"name":"invitationCreatedAt","type":"\t","is_mandatory":true,"title":"Time the pending invitation to the organization was sent, null once the member is active","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"invitationExpiresAt":{"name":"invitationExpiresAt","type":"\t","is_mandatory":true,"title":"Time the pending invitation to the organization expires, null once the member is active","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"inviterUsername":{"name":"inviterUsername","type":"\u0007","is_mandatory":true,"title":"Login name of the member who sent the pending invitation, null once the member is active","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"lastAuth":{"name":"lastAuth","type":"\t","is_mandatory":true,"title":"Time the member last authenticated","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"orgMembershipStatus":{"name":"orgMembershipStatus","type":"\u0007","is_mandatory":true,"title":"Membership status (ACTIVE or PENDING)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"orgRoles":{"name":"orgRoles","type":"\u0019\u0007","is_mandatory":true,"title":"Organization-level roles granted to the member","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projectRole":{"name":"projectRole","type":"\u001bmongodbatlas.orgUser.projectRole","title":"Project roles held by an organization member","desc":"The set of project-level roles one organization member holds on a single project, covering the project the grant applies to and the roles held there. Project roles are granted independently of organization roles, so a member with no organization role can still hold GROUP_OWNER on a project. Auditing these surfaces administrative grants on projects a member does not need, and members whose only remaining access is a single project grant.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"projectRoles":{"name":"projectRoles","type":"\u0019\u001bmongodbatlas.orgUser.projectRole","title":"Project-level roles granted to the member, one entry per project","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"teams":{"name":"teams","type":"\u0019\u001bmongodbatlas.team","title":"Teams the member belongs to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Login name (email)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas organization member","desc":"A user account that is a member of the organization, keyed by username (the login email). Covers the membership status, the organization-level roles, per-project role assignments, team memberships, and the last authentication time. A member whose orgMembershipStatus is PENDING has been invited but has never signed in, and the invitation fields report when that invitation was sent, when it expires, and who sent it. Select a member by username, for example `mongodbatlas.orgUsers.where(username == \"alice@example.com\")`.","min_provider_version":"13.0.0","defaults":"username orgMembershipStatus","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.orgUser.projectRole":{"id":"mongodbatlas.orgUser.projectRole","name":"mongodbatlas.orgUser.projectRole","fields":{"project":{"name":"project","type":"\u001bmongodbatlas.project","title":"Project the roles apply to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles granted on the project","desc":"Values such as GROUP_OWNER, GROUP_CLUSTER_MANAGER, GROUP_DATA_ACCESS_ADMIN, GROUP_DATA_ACCESS_READ_WRITE, GROUP_DATA_ACCESS_READ_ONLY, GROUP_SEARCH_INDEX_EDITOR, GROUP_STREAM_PROCESSING_OWNER, GROUP_BACKUP_MANAGER, and GROUP_READ_ONLY.","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"Project roles held by an organization member","desc":"The set of project-level roles one organization member holds on a single project, covering the project the grant applies to and the roles held there. Project roles are granted independently of organization roles, so a member with no organization role can still hold GROUP_OWNER on a project. Auditing these surfaces administrative grants on projects a member does not need, and members whose only remaining access is a single project grant.","private":true,"min_provider_version":"13.1.4","defaults":"roles","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.privateEndpointService":{"id":"mongodbatlas.privateEndpointService","name":"mongodbatlas.privateEndpointService","fields":{"cloudProvider":{"name":"cloudProvider","type":"\u0007","is_mandatory":true,"title":"Cloud provider (AWS, AZURE, or GCP)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"errorMessage":{"name":"errorMessage","type":"\u0007","is_mandatory":true,"title":"Error message when the endpoint service is in an error state","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Endpoint service id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"interfaceEndpoints":{"name":"interfaceEndpoints","type":"\u0019\u0007","is_mandatory":true,"title":"Interface endpoint ids attached to the service","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"regionName":{"name":"regionName","type":"\u0007","is_mandatory":true,"title":"Region the endpoint service is in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Status of the endpoint service","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas private endpoint service","desc":"A private endpoint service configured for the project on a single cloud provider, keyed by id. Private endpoints let clients reach clusters over the cloud provider's private network instead of the public internet. Covers the cloud provider, region, status, and the underlying endpoint identifiers.","min_provider_version":"13.0.0","defaults":"cloudProvider regionName status","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.project":{"id":"mongodbatlas.project","name":"mongodbatlas.project","fields":{"clusterCount":{"name":"clusterCount","type":"\u0005","is_mandatory":true,"title":"Number of clusters in the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the project was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Project id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Project name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"orgId":{"name":"orgId","type":"\u0007","is_mandatory":true,"title":"Id of the organization that owns the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"regionUsageRestrictions":{"name":"regionUsageRestrictions","type":"\u0007","is_mandatory":true,"title":"Government region restriction (Atlas for Government), empty for commercial projects","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas project","desc":"A project (also called a group) in the organization, keyed by id. Covers the owning organization, the number of clusters, the creation time, and any government region restrictions. Select a project by name, for example `mongodbatlas.projects.where(name == \"production\")`.","min_provider_version":"13.0.0","defaults":"name id orgId","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.projectConfig":{"id":"mongodbatlas.projectConfig","name":"mongodbatlas.projectConfig","fields":{"isClusterAiAssistantEnabled":{"name":"isClusterAiAssistantEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the AI Cluster Assistant is enabled for the project","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isCollectDatabaseSpecificsStatisticsEnabled":{"name":"isCollectDatabaseSpecificsStatisticsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether collection of database-specific statistics is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isDataExplorerEnabled":{"name":"isDataExplorerEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Data Explorer (in-console data browsing) is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isDataExplorerGenAIFeaturesEnabled":{"name":"isDataExplorerGenAIFeaturesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Data Explorer generative AI features are enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isDataExplorerGenAISampleDocumentPassingEnabled":{"name":"isDataExplorerGenAISampleDocumentPassingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether sample field values are sent with Data Explorer generative AI requests","desc":"Distinct from isDataExplorerGenAIFeaturesEnabled, which only enables the feature in the console. This flag is the one that sends real document values to a third-party model.","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isDataValidationEnabled":{"name":"isDataValidationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether data validation is enabled for every cluster in the project","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isExtendedStorageSizesEnabled":{"name":"isExtendedStorageSizesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether extended storage sizes are enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isNativeRerankingEnabled":{"name":"isNativeRerankingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether native reranking with third-party models in the aggregation pipeline is enabled","min_provider_version":"13.4.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isPerformanceAdvisorEnabled":{"name":"isPerformanceAdvisorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Performance Advisor is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isRealtimePerformancePanelEnabled":{"name":"isRealtimePerformancePanelEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the real-time performance panel is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"isSchemaAdvisorEnabled":{"name":"isSchemaAdvisorEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Schema Advisor is enabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas project feature settings","desc":"Feature toggles for the project, such as whether the Data Explorer and its generative AI features are enabled and whether the performance and schema advisors are active. These govern which in-console data-access and analysis features are exposed.","min_provider_version":"13.0.0","defaults":"isDataExplorerEnabled","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.projectInvitation":{"id":"mongodbatlas.projectInvitation","name":"mongodbatlas.projectInvitation","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the invitation was sent","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the invitation expires","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Invitation id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"inviterUsername":{"name":"inviterUsername","type":"\u0007","is_mandatory":true,"title":"Login name of the member who sent the invitation","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles the invitation grants on acceptance","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Address the invitation was sent to","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas project invitation","desc":"An invitation to the project that has been sent and not accepted, keyed by invitation id. Covers the invited address, the roles the invitation carries, who sent it, when it was sent, and when it expires. Until it expires or is withdrawn, it is a standing grant to whoever controls the invited address.","min_provider_version":"13.4.1","defaults":"username roles expiresAt","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.projectTeam":{"id":"mongodbatlas.projectTeam","name":"mongodbatlas.projectTeam","fields":{"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles the team holds on the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"team":{"name":"team","type":"\u001bmongodbatlas.team","title":"Team the roles are granted to","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas project team grant","desc":"A team granted roles on the project. The grant is what gives every member of the team the named roles, so a team with a broad membership and a GROUP_OWNER grant reaches further than any individual assignment shows. Resolving the team itself needs organization access, so team is null when the connected credential is scoped to the project.","private":true,"min_provider_version":"13.4.1","defaults":"roles","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.projectUser":{"id":"mongodbatlas.projectUser","name":"mongodbatlas.projectUser","fields":{"country":{"name":"country","type":"\u0007","is_mandatory":true,"title":"Country the user account is registered in","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the user account was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"User id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"invitationCreatedAt":{"name":"invitationCreatedAt","type":"\t","is_mandatory":true,"title":"Time the invitation was sent, null for a member who is not pending","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"invitationExpiresAt":{"name":"invitationExpiresAt","type":"\t","is_mandatory":true,"title":"Time the invitation expires, null for a member who is not pending","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"inviterUsername":{"name":"inviterUsername","type":"\u0007","is_mandatory":true,"title":"Login name of the member who sent the invitation","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"lastAuth":{"name":"lastAuth","type":"\t","is_mandatory":true,"title":"Time the user last authenticated, null when they never have","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"orgMembershipStatus":{"name":"orgMembershipStatus","type":"\u0007","is_mandatory":true,"title":"Organization membership status (ACTIVE or PENDING)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles the user holds on the project","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Login name (email)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas project member","desc":"A user holding at least one role on the project, keyed by user id. Covers the login name, the project roles held, the organization membership status, the last authentication time, and the invitation fields for a member who has been invited but has never signed in. Project-scoped access is otherwise only visible from the organization side, which a project-scoped credential cannot read. Select a member by username, for example `mongodbatlas.projectUsers.where(username == \"alice@example.com\")`.","min_provider_version":"13.4.1","defaults":"username roles orgMembershipStatus","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.pushBasedLogConfig":{"id":"mongodbatlas.pushBasedLogConfig","name":"mongodbatlas.pushBasedLogConfig","fields":{"bucketName":{"name":"bucketName","type":"\u0007","is_mandatory":true,"title":"Name of the AWS S3 bucket logs are delivered to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"cloudProviderAccessRole":{"name":"cloudProviderAccessRole","type":"\u001bmongodbatlas.cloudProviderAccessRole","title":"Cloud provider access role Atlas assumes to write to the bucket","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"prefixPath":{"name":"prefixPath","type":"\u0007","is_mandatory":true,"title":"Object key prefix under which logs are written in the bucket","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Configuration state (such as ACTIVE, UNCONFIGURED, or INITIATING)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas push-based log export configuration","desc":"The push-based log export configuration for the project, which delivers database audit and access logs to a customer-owned AWS S3 bucket. Covers the destination bucket, the AWS IAM role Atlas assumes to write to it, the object key prefix, and the configuration state. Present only when push-based log export has been configured, and null otherwise.","min_provider_version":"13.0.1","defaults":"state bucketName","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.resourcePolicy":{"id":"mongodbatlas.resourcePolicy","name":"mongodbatlas.resourcePolicy","fields":{"createdByUser":{"name":"createdByUser","type":"\u0007","is_mandatory":true,"title":"Name of the user who created the policy","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createdDate":{"name":"createdDate","type":"\t","is_mandatory":true,"title":"Time the policy was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the resource policy","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource policy id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"lastUpdatedByUser":{"name":"lastUpdatedByUser","type":"\u0007","is_mandatory":true,"title":"Name of the user who last updated the policy","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"lastUpdatedDate":{"name":"lastUpdatedDate","type":"\t","is_mandatory":true,"title":"Time the policy was last updated","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource policy name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"policies":{"name":"policies","type":"\u0019\n","is_mandatory":true,"title":"Policy statements, each with its id and Cedar policy body","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas resource policy","desc":"An organization-level Atlas Resource Policy, keyed by id. Resource policies are Cedar-based guardrails that constrain what actions can be taken on Atlas resources across the organization (for example restricting the cloud providers or regions clusters may deploy to). Covers the name, description, the users and times of creation and last update, and the individual policy statements. Select a policy by name, for example `mongodbatlas.resourcePolicies.where(name == \"restrict-regions\")`.","min_provider_version":"13.0.1","defaults":"name id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.roleMapping":{"id":"mongodbatlas.roleMapping","name":"mongodbatlas.roleMapping","fields":{"externalGroupName":{"name":"externalGroupName","type":"\u0007","is_mandatory":true,"title":"Name of the identity provider group the mapping matches","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role mapping id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"orgRoles":{"name":"orgRoles","type":"\u0019\u0007","is_mandatory":true,"title":"Organization roles the mapping grants (such as ORG_OWNER)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projectRole":{"name":"projectRole","type":"\u001bmongodbatlas.roleMapping.projectRole","title":"MongoDB Atlas role mapping project grant","desc":"The roles one federation role mapping grants on a single project, together with the project they apply to.","is_private":true,"provider":"go.mondoo.com/mql/providers/mongodbatlas","is_implicit_resource":true},"projectRoles":{"name":"projectRoles","type":"\u0019\u001bmongodbatlas.roleMapping.projectRole","title":"Project-scoped roles the mapping grants","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas federation role mapping","desc":"A rule granting Atlas roles to the members of one identity provider group, keyed by mapping id. Covers the external group name and the organization and project roles it confers. This is what answers which provider group grants a privileged role, which the federation-wide hasRoleMappings flag can only say exists. Select a mapping by group, for example `mongodbatlas.federationSettings.connectedOrgConfigs.first.roleMappings.where(externalGroupName == \"atlas-admins\")`.","min_provider_version":"13.4.1","defaults":"externalGroupName orgRoles","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.roleMapping.projectRole":{"id":"mongodbatlas.roleMapping.projectRole","name":"mongodbatlas.roleMapping.projectRole","fields":{"project":{"name":"project","type":"\u001bmongodbatlas.project","title":"Project the roles apply to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles granted on the project (such as GROUP_OWNER)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas role mapping project grant","desc":"The roles one federation role mapping grants on a single project, together with the project they apply to.","private":true,"min_provider_version":"13.4.1","defaults":"roles","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.searchIndex":{"id":"mongodbatlas.searchIndex","name":"mongodbatlas.searchIndex","fields":{"collectionName":{"name":"collectionName","type":"\u0007","is_mandatory":true,"title":"Collection the index is built on","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"database":{"name":"database","type":"\u0007","is_mandatory":true,"title":"Database the index is built on","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Index id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"latestDefinition":{"name":"latestDefinition","type":"\n","is_mandatory":true,"title":"Most recent index definition","desc":"The full index configuration. For a vector search index this holds the fields (each with a type of vector or filter, numDimensions, similarity, and path) and numPartitions. For a full-text search index it holds the analyzer, analyzers, mappings, searchAnalyzer, synonyms, and the storedSource clause that governs which document fields are copied into the index.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"latestDefinitionVersion":{"name":"latestDefinitionVersion","type":"\n","is_mandatory":true,"title":"Version metadata for the most recent index definition, with version and createdAt","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Index name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"queryable":{"name":"queryable","type":"\u0004","is_mandatory":true,"title":"Whether the index is currently queryable","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Build status","desc":"One of READY, BUILDING, FAILED, STALE, PENDING, or DELETING.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"statusDetail":{"name":"statusDetail","type":"\u0019\n","is_mandatory":true,"title":"Per-host build status detail","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Index kind","desc":"The discriminator between the two index families: \"search\" for a full-text Atlas Search index and \"vectorSearch\" for an Atlas Vector Search index.","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas search or vector search index","desc":"A single Atlas Search or Atlas Vector Search index defined on a cluster, covering both index kinds through the type discriminator: \"search\" for a full-text Atlas Search index and \"vectorSearch\" for an Atlas Vector Search index. Reports the database and collection the index is built on, its build status and whether it is currently queryable, and the full index definition. The latestDefinition field carries the index configuration: for vector search the vector and filter fields with their numDimensions, similarity function, and path, plus numPartitions; for full-text search the analyzer, analyzers, mappings, searchAnalyzer, synonyms, and the storedSource clause that governs which document fields are copied into the index.","min_provider_version":"13.0.1","defaults":"name type database collectionName status","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.serviceAccount":{"id":"mongodbatlas.serviceAccount","name":"mongodbatlas.serviceAccount","fields":{"accessList":{"name":"accessList","type":"\u0019\u001bmongodbatlas.apiAccessListEntry","title":"API access list entries restricting where the service account may be used from, empty when it is usable from any address","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"OAuth client id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the service account was created","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the service account","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service account name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"projects":{"name":"projects","type":"\u0019\u001bmongodbatlas.project","title":"Projects the service account is assigned to","min_provider_version":"13.2.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Organization roles granted to the service account","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"secrets":{"name":"secrets","type":"\u0019\n","is_mandatory":true,"title":"Issued secrets, each with its id, creation, expiry, and last-used times (no secret values)","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas service account","desc":"A service account in the organization, keyed by its client id. Covers the granted organization roles and the secrets issued to it (their ids and expiry times, never the secret values). Select an account by client id, for example `mongodbatlas.serviceAccounts.where(name == \"automation\")`.","min_provider_version":"13.0.0","defaults":"name clientId","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.snapshotExportBucket":{"id":"mongodbatlas.snapshotExportBucket","name":"mongodbatlas.snapshotExportBucket","fields":{"bucketName":{"name":"bucketName","type":"\u0007","is_mandatory":true,"title":"Name of the storage bucket (an AWS S3 bucket or an Azure Blob Storage container)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"cloudProvider":{"name":"cloudProvider","type":"\u0007","is_mandatory":true,"title":"Cloud provider hosting the bucket (AWS or AZURE)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"cloudProviderAccessRole":{"name":"cloudProviderAccessRole","type":"\u001bmongodbatlas.cloudProviderAccessRole","title":"Cloud provider access role Atlas assumes to write snapshots to the bucket","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Export bucket id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Azure region the storage account is in, null for an AWS bucket","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"requirePrivateNetworking":{"name":"requirePrivateNetworking","type":"\u0004","is_mandatory":true,"title":"Whether snapshot export traffic is confined to private networking","desc":"When false, exported snapshots travel to the bucket over the public internet, so backup data leaves Atlas across a path the project does not control.","min_provider_version":"13.3.1","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"serviceUrl":{"name":"serviceUrl","type":"\u0007","is_mandatory":true,"title":"Azure Blob Storage service URL, null for an AWS bucket","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"tenantId":{"name":"tenantId","type":"\u0007","is_mandatory":true,"title":"Azure tenant id that owns the storage account, null for an AWS bucket","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas snapshot export bucket","desc":"A cloud storage bucket that cloud backup snapshots for the project can be exported to, keyed by id. Covers the bucket name, the cloud provider and region holding it, and the cloud provider access role Atlas assumes to write to it. An export bucket is a path for backup data to leave Atlas, so both the destination account and the role authorizing the write are worth auditing.","min_provider_version":"13.1.4","defaults":"bucketName cloudProvider","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.team":{"id":"mongodbatlas.team","name":"mongodbatlas.team","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Team id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Team name","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"users":{"name":"users","type":"\u0019\u001bmongodbatlas.orgUser","title":"Members of the team","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas team","desc":"A team in the organization, keyed by name. Teams group members for role assignment on projects. Select a team by name, for example `mongodbatlas.teams.where(name == \"platform\")`.","min_provider_version":"13.0.0","defaults":"name id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.thirdPartyIntegration":{"id":"mongodbatlas.thirdPartyIntegration","name":"mongodbatlas.thirdPartyIntegration","fields":{"accountId":{"name":"accountId","type":"\u0007","is_mandatory":true,"title":"Account the integration reports into","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"channelName":{"name":"channelName","type":"\u0007","is_mandatory":true,"title":"Slack channel notifications are delivered to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the integration is active, null for a kind that carries no enabled flag","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"endpointHost":{"name":"endpointHost","type":"\u0007","is_mandatory":true,"title":"Host the integration delivers to, null when the kind carries no destination address","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"hasSecret":{"name":"hasSecret","type":"\u0004","is_mandatory":true,"title":"Whether a webhook secret is configured, so deliveries are signed","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Integration id","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Regional endpoint the service is reached through","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"sendCollectionLatencyMetrics":{"name":"sendCollectionLatencyMetrics","type":"\u0004","is_mandatory":true,"title":"Whether collection latency metrics, including database and collection names, are sent","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"sendDatabaseMetrics":{"name":"sendDatabaseMetrics","type":"\u0004","is_mandatory":true,"title":"Whether database metrics, including database names, are sent","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"sendQueryStatsMetrics":{"name":"sendQueryStatsMetrics","type":"\u0004","is_mandatory":true,"title":"Whether query shape metrics, including query hashes, are sent","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"sendUserProvidedResourceTags":{"name":"sendUserProvidedResourceTags","type":"\u0004","is_mandatory":true,"title":"Whether project and cluster resource tags are sent alongside the metrics","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"serviceDiscovery":{"name":"serviceDiscovery","type":"\u0007","is_mandatory":true,"title":"How the service is discovered, for a Prometheus integration","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"teamName":{"name":"teamName","type":"\u0007","is_mandatory":true,"title":"Slack team the channel belongs to","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Service kind (such as WEBHOOK, SLACK, DATADOG, PAGER_DUTY, PROMETHEUS, or MICROSOFT_TEAMS)","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username the integration authenticates as","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas third-party service integration","desc":"One service the project routes alerts and metrics to, keyed by integration type. Covers the service kind, whether it is active, the regional endpoint it uses, the channel or account it delivers into, and which metric categories a metrics integration is allowed to send. The Atlas record carries an API token, an API key, a service key, a licence key, a read and write token, a webhook secret, and a password inline; none are exposed. A destination address is reduced to its host, and hasSecret reports only whether a webhook secret is configured. Select an integration by type, for example `mongodbatlas.thirdPartyIntegrations.where(type == \"WEBHOOK\")`.","min_provider_version":"13.4.1","defaults":"type endpointHost","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"mongodbatlas.userSecurityConfig":{"id":"mongodbatlas.userSecurityConfig","name":"mongodbatlas.userSecurityConfig","fields":{"customerX509CasConfigured":{"name":"customerX509CasConfigured","type":"\u0004","is_mandatory":true,"title":"Whether a customer certificate authority is configured for X.509 database users","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapAuthenticationEnabled":{"name":"ldapAuthenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether database users may authenticate against the LDAP host","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapAuthorizationEnabled":{"name":"ldapAuthorizationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether MongoDB Cloud resource authorization is resolved through LDAP groups","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapAuthzQueryTemplate":{"name":"ldapAuthzQueryTemplate","type":"\u0007","is_mandatory":true,"title":"Query template Atlas runs to resolve the groups of an authenticated user","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapBindUsername":{"name":"ldapBindUsername","type":"\u0007","is_mandatory":true,"title":"Distinguished name Atlas binds to the LDAP host as","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapCaCertificateConfigured":{"name":"ldapCaCertificateConfigured","type":"\u0004","is_mandatory":true,"title":"Whether a certificate authority is configured for verifying the LDAP host","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapHostname":{"name":"ldapHostname","type":"\u0007","is_mandatory":true,"title":"Hostname or address of the LDAP host","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapPort":{"name":"ldapPort","type":"\u0005","is_mandatory":true,"title":"Port the LDAP host listens on","desc":"636 is the LDAPS port; 389 is plaintext LDAP, over which the bind credentials and the directory responses cross the network unprotected.","provider":"go.mondoo.com/mql/providers/mongodbatlas"},"ldapUserToDnMappings":{"name":"ldapUserToDnMappings","type":"\u0019\n","is_mandatory":true,"title":"Username to distinguished name mappings, each with match, ldapQuery, and substitution","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"title":"MongoDB Atlas LDAP and X.509 user security settings","desc":"The project's external authentication configuration. Covers the LDAP host used for authentication and authorization, the account Atlas binds with, the authorization query template, the username-to-distinguished-name mappings, and whether a customer certificate authority is configured for X.509 database users. The LDAP bind password and the certificate authority material are never exposed; ldapCaCertificateConfigured and customerX509CasConfigured report only whether each is set. An LDAP host reachable on a port that does not carry TLS makes the credentials that cross it readable in transit.","min_provider_version":"13.4.1","defaults":"ldapAuthenticationEnabled ldapHostname ldapPort","provider":"go.mondoo.com/mql/providers/mongodbatlas"}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/mongodbatlas":"mongodbatlas"}}