---
subcategory: "Projects"
---

# Resource: mongodbatlas_project_ip_access_list

`mongodbatlas_project_ip_access_list` provides an IP Access List entry resource. The access list grants access from IPs, CIDRs or AWS Security Groups (if VPC Peering is enabled) to clusters within the Project.

The [Official MongoDB Atlas Project Module](https://registry.terraform.io/modules/terraform-mongodbatlas-modules/project/mongodbatlas/latest) makes use of this resource and simplifies IP access list configuration as part of project management.

~> **IMPORTANT:** When you remove an entry from the access list, existing connections from the removed address(es) may remain open for a variable amount of time. How much time passes before Atlas closes the connection depends on several factors, including how the connection was established, the particular behavior of the application or driver using the address, and the connection protocol (e.g., TCP or UDP). This is particularly important to consider when changing an existing IP address or CIDR block as they cannot be updated via the Provider, hence a change will force the destruction and recreation of entries.

~> **IMPORTANT:** During creation this resource does not validate whether the specified `ip_address`, `cidr_block`, or `aws_security_group` already exists in the project's access list (known limitation). Defining a duplicate entry will result in a successful resource creation associated to the existing entry.

## Example Usage

### Using CIDR Block
```terraform
resource "mongodbatlas_project_ip_access_list" "this" {
  project_id = var.project_id
  cidr_block = "1.2.3.4/32"
  comment    = "cidr block test"
}
```

### Using IP Address
```terraform
resource "mongodbatlas_project_ip_access_list" "this" {
  project_id = var.project_id
  ip_address = "2.3.4.5"
  comment    = "ip address test"
}
```

### Using an AWS Security Group
```terraform
resource "mongodbatlas_network_container" "this" {
  project_id       = var.project_id
  atlas_cidr_block = "192.168.208.0/21"
  provider_name    = "AWS"
  region_name      = "US_EAST_1"
}

resource "mongodbatlas_network_peering" "this" {
  project_id             = var.project_id
  container_id           = mongodbatlas_network_container.this.container_id
  accepter_region_name   = "us-east-1"
  provider_name          = "AWS"
  route_table_cidr_block = "172.31.0.0/16"
  vpc_id                 = "vpc-0d93d6f69f1578bd8"
  aws_account_id         = "232589400519"
}

resource "mongodbatlas_project_ip_access_list" "this" {
  project_id         = var.project_id
  aws_security_group = "sg-0026348ec11780bd1"
  comment            = "AWS Security Group test"

  depends_on = ["mongodbatlas_network_peering.this"]
}
```

~> **IMPORTANT:** In order to use AWS Security Group(s) VPC Peering must be enabled like above example.


### Further Examples
- [Project IP Access List](https://github.com/mongodb/terraform-provider-mongodbatlas/tree/v2.20.1/examples/mongodbatlas_project_ip_access_list)

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `project_id` (String) Unique 24-hexadecimal digit string that identifies your project, also known as `groupId` in the official documentation.

### Optional

- `aws_security_group` (String) Unique identifier of the AWS security group to add to the access list. Mutually exclusive with `cidr_block` and `ip_address`.
- `cidr_block` (String) Range of IP addresses in CIDR notation to be added to the access list. Mutually exclusive with `ip_address` and `aws_security_group`.
- `comment` (String) Remark that explains the purpose or scope of this IP access list entry.
- `ip_address` (String) Single IP address to be added to the access list. Mutually exclusive with `cidr_block` and `aws_security_group`.
- `timeouts` (Attributes) (see [below for nested schema](#nestedatt--timeouts))

### Read-Only

- `id` (String) Unique identifier used for terraform for internal management.

<a id="nestedatt--timeouts"></a>
### Nested Schema for `timeouts`

Optional:

- `delete` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), and "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs. Default: `45m`.
- `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), and "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled. Default: `2m`.

## Import

IP Access List entries can be imported using the `project_id` and `cidr_block` or `ip_address`, e.g.

```
$ terraform import mongodbatlas_project_ip_access_list.this 5d0f1f74cf09a29120e123cd-10.242.88.0/21
```

For more information, see [MongoDB Atlas API Reference](https://www.mongodb.com/docs/atlas/reference/api/access-lists/).