보안 강화 및 운영 환경 점검 목록

// Verify authentication is required
// (attempt to connect without credentials — should fail)
try {
  const client = new MongoClient('mongodb://localhost:27017')
  await client.connect()
  await client.db('admin').command({ ping: 1 })
  console.log('AUTH MISSING — unauthenticated connections accepted!')
} catch (e) {
  console.log('Good: unauthenticated connections rejected')
}

// List all admin users and their roles
use admin
db.getUsers()  // verify no app user has 'root' role

// Audit access matrix
const accessMatrix = [
  { service: 'api-server',       user: 'apiSvc',        roles: [{ role: 'readWrite', db: 'ecommerce' }] },
  { service: 'analytics-job',   user: 'analyticsSvc',  roles: [{ role: 'read', db: 'ecommerce' }] },
  { service: 'backup-agent',    user: 'backupAgent',   roles: [{ role: 'backup', db: 'admin' }] },
  { service: 'monitoring-exp',  user: 'prometheusExp', roles: [{ role: 'clusterMonitor', db: 'admin' }] }
]

// Verify each user's actual roles match the matrix
accessMatrix.forEach(entry => {
  const user = db.getSiblingDB('admin').getUser(entry.user)
  console.log(entry.service, user ? 'OK' : 'MISSING')
})

// Verify TLS is active on the server
const netStatus = db.adminCommand({ serverStatus: 1 }).network
console.log('TLS connections:', netStatus.serviceExecutorTaskStats)

// Confirm connection string includes TLS
// mongodb+srv:// always uses TLS
// Self-hosted: mongodb://host:27017/?tls=true

// Check mongod.conf programmatically
// grep 'mode: requireTLS' /etc/mongod.conf

# mongod.conf — bind only to localhost and private network interface
net:
  bindIp: 127.0.0.1,10.0.0.5  # never 0.0.0.0 in production
  port: 27017

# Firewall rule (iptables example — block public access to 27017)
# iptables -A INPUT -p tcp --dport 27017 -s 10.0.0.0/8 -j ACCEPT
# iptables -A INPUT -p tcp --dport 27017 -j DROP

# mongodump — daily backup to S3
mongodump \
  --uri 'mongodb://backupAgent:pass@host:27017/?authSource=admin' \
  --gzip \
  --archive=/tmp/backup-$(date +%Y%m%d).gz

# Upload to S3
aws s3 cp /tmp/backup-$(date +%Y%m%d).gz s3://my-mongo-backups/

# Verify backup integrity — test restore to a separate cluster
mongorestore \
  --uri 'mongodb://host2:27017' \
  --gzip \
  --archive=/tmp/backup-$(date +%Y%m%d).gz \
  --drop

// Key Atlas alerts to configure (examples)
const alerts = [
  { metric: 'DISK_UTILIZATION',       threshold: '80%',  severity: 'WARNING' },
  { metric: 'CPU_SYSTEM_NORMALIZED',  threshold: '70%',  severity: 'WARNING' },
  { metric: 'REPLICATION_LAG',        threshold: '10s',  severity: 'CRITICAL' },
  { metric: 'CONNECTIONS',            threshold: '80%',  severity: 'WARNING' },
  { metric: 'CACHE_DIRTY_BYTES',      threshold: '20%',  severity: 'WARNING' }
]

// Enable profiler and set slow query threshold
db.setProfilingLevel(1, { slowms: 50 })  // log queries > 50ms

// After load test, query profiler for summary
db.system.profile.aggregate([
  {
    $group: {
      _id: '$ns',
      avgMs:    { $avg: '$millis' },
      maxMs:    { $max: '$millis' },
      count:    { $sum: 1 },
      slowOps:  { $sum: { $cond: [{ $gt: ['$millis', 100] }, 1, 0] } }
    }
  },
  { $sort: { avgMs: -1 } }
])

// Verify Atlas encryption at rest is enabled via Atlas Admin API
curl -u 'PUBLIC_KEY:PRIVATE_KEY' --digest \
  'https://cloud.mongodb.com/api/atlas/v1.0/groups/GROUP_ID/encryptionAtRest'
// Response should show: 'awsKms.enabled': true (or azure/gcp equivalent)

// For self-hosted, check mongod.conf
// grep 'enableEncryption' /etc/mongod.conf
// Expected: enableEncryption: true

# mongod.conf — enable audit logging (Enterprise)
auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json
  filter: '{
    atype: {
      $in: ["authenticate", "authCheck", "createUser", "dropUser",
            "logout", "createCollection", "dropCollection"]
    }
  }'

// Runbook checklist (document in your team wiki)
const runbook = {
  emergencyConnect: 'mongosh mongodb+srv://adminUser:***@cluster.mongodb.net',
  checkReplicaStatus: 'rs.status()',
  triggerManualFailover: 'rs.stepDown()  // on current primary',
  viewReplicationLag: 'rs.printSlaveReplicationInfo()',
  restoreFromBackup: 'atlas backups restores start --clusterName prod',
  contactList: ['dba-oncall@company.com', '+1-800-DBA-HELP'],
  rto: '15 minutes',
  rpo: '5 seconds (continuous backup)'
}