## How Atlan connects to Amazon DocumentDB

URL: https://docs.atlan.com/apps/connectors/database/documentdb/concepts/how-atlan-connects-to-documentdb

> Understand how Atlan securely connects to your Amazon DocumentDB cluster to extract metadata.

Atlan connects to your Amazon DocumentDB cluster to extract technical metadata while maintaining network security and compliance. Because DocumentDB clusters have no public endpoint and are reachable only from within your VPC, Atlan connects **exclusively through Self-Deployed Runtime** deployed in the same VPC as your cluster.

:::warning Direct connectivity isn't supported
Unlike most Atlan connectors, Amazon DocumentDB can't be crawled directly from Atlan Cloud. Self-Deployed Runtime is the only supported connection method. For why direct internet connectivity and experimental proxy patterns aren't supported, see [Why is Amazon DocumentDB supported only through self-deployed runtime?](https://docs.atlan.com/llms/connectors/documentdb/connectivity-and-deployment/llms.txt) in the FAQ.

SDR requires additional enablement and licensing. Contact your Atlan representative for details.
:::

## Connect via self-deployed runtime

A runtime service deployed within your network acts as a secure bridge between Atlan Cloud and your Amazon DocumentDB cluster. You deploy the runtime inside the same VPC as your cluster, where it can reach the cluster endpoint over the private network while your cluster remains fully isolated from the internet.

```mermaid
sequenceDiagram
 participant User as User
 participant Atlan as Atlan SaaS Tenant
 participant Runtime as Self-Deployed Runtime 
 (same VPC as Amazon DocumentDB cluster)
 participant SecretStore as Secret Store
 participant DocumentDB as Amazon DocumentDB

 User->>Atlan: Configure and schedule crawler workflow 
(non-sensitive connection details)
 Runtime->>Atlan: Poll for job execution request 
(via outbound HTTPS)
 Runtime->>SecretStore: Request sensitive credentials 
(password, IAM credentials)
 SecretStore->>Runtime: Return credentials
 Runtime->>DocumentDB: Establish local connection 
(default port 27017)
 Runtime->>DocumentDB: Run read-only queries for databases, collections, 
 and sampled documents
 DocumentDB->>Runtime: Return metadata 
(databases, collections, inferred field schemas)
 Runtime->>Atlan: Send metadata results 
(via HTTPS)
 Atlan->>Atlan: Catalog results in Atlan
 User->>Atlan: View assets in Atlan
```
- The runtime maintains an outbound HTTPS connection to Atlan Cloud (port 443) and a local network connection to your DocumentDB cluster (port 27017).
- The runtime translates requests into DocumentDB queries, executes them on your cluster, and returns the results to Atlan Cloud.

For details on how Self-Deployed Runtime works, see [SDR connectivity](https://docs.atlan.com/llms/catalog/connector-capabilities/sdr-connectivity/llms.txt).

## Security

Atlan extracts structural metadata—databases, collections, and field schemas inferred from a sample of documents. For example, if you have a `customers` collection, Atlan discovers the collection and its inferred field schema, but never catalogs the customer records themselves.

- **Read-only operations**: All cluster queries are read-only operations. The connector can't modify data, create or drop database objects, or change any configuration. The DocumentDB user permissions you grant control exactly what the connector can access.

- **Credential encryption**: DocumentDB connection credentials never leave your network perimeter. The runtime retrieves them from your enterprise-managed secret vaults (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, or HashiCorp Vault) only when needed, and Atlan Cloud never receives or stores them.

- **Network isolation**: Your DocumentDB cluster gains complete network isolation from the internet. The cluster only accepts connections from the runtime within your VPC. The runtime itself only makes outbound HTTPS connections to Atlan Cloud, which your network team can control through security group rules.

## See also

* [Why is Amazon DocumentDB supported only through self-deployed runtime?](https://docs.atlan.com/llms/connectors/documentdb/connectivity-and-deployment/llms.txt): Why Self-Deployed Runtime is the only supported connection method.
* [SDR connectivity](https://docs.atlan.com/llms/catalog/connector-capabilities/sdr-connectivity/llms.txt): How Self-Deployed Runtime connects to data sources.
* [Set up Amazon DocumentDB](https://docs.atlan.com/llms/connectors/documentdb/set-up-documentdb/llms.txt): Configure user accounts and permissions.

---