Plan the application’s route to a PD AWS DocumentDB cluster before provisioning it. Amazon DocumentDB clusters do not provide a public internet endpoint. An allowed public IP or a correct password cannot replace a private network path.

Identify where the application connects

Use an application server inside the cluster’s AWS network, or an established private connection into that network. An SSH tunnel through a suitable server is another option for approved remote access. This module does not create that server, tunnel or private route for you.

AWS explains DocumentDB connectivity. Ask the AWS administrator to check the cluster’s VPC, subnets, DNS, routing and security-group access for the application’s actual source. The module arranges its dedicated firewall group in the selected region’s default VPC, so review that prerequisite before the first order.

Keep the offering private

Open the product’s Module Settings tab. If the form shows Network access, retain private access. Older forms can show Publicly accessible instead; leave it off. That older label does not make DocumentDB internet-facing.

Allow only the application sources that need access. Do not open all source addresses to diagnose a timeout. Existing services need the administrator to confirm that their firewall is dedicated before changing rules; this planning guide does not instruct a firewall migration or update.

Distinguish connectivity from authentication

Check the cluster’s current state, endpoint and port. Timeouts call for network checks; a login refusal calls for private review of the database credentials. Use TLS with the correct Amazon CA bundle and preserve certificate verification. AWS management keys are separate from the application login and must never be pasted into a connection string or ticket.

See the PD AWS DocumentDB WHMCS guide for related tasks, or explore PD AWS DocumentDB.