Help Center/ Document Database Service/ User Guide/ Connecting to a DDS Instance/ Connecting to a Cluster Instance/ Connecting to a Cluster Instance over a Private Network/ Connecting to Read Replicas Using Mongo Shell
Updated on 2026-08-04 GMT+08:00
View PDF
Share

Connecting to Read Replicas Using Mongo Shell

Scenarios

Mongo shell is the default client for the MongoDB database server. You can use Mongo Shell to connect to DB instances, and query, update, and manage data in databases. DDS is compatible with MongoDB. Mongo Shell is a part of the MongoDB client. To use Mongo Shell, download and install the MongoDB client first, and then use the Mongo shell to connect to the DB instance.

By default, a DDS instance provides a private IP address. If your applications are deployed on an ECS and are in the same region and VPC as DDS instances, you can connect to DDS instances using a private IP address to achieve a fast transmission rate and high security.

This section uses an ECS-based application as an example and describes how to use Mongo Shell to connect to a read replica of a cluster instance over a private network.

You can connect to a read replica using an SSL connection or an unencrypted connection. The SSL connection is encrypted and more secure. To improve data transmission security, connect to read replicas using SSL.

Prerequisites

  1. For details about how to create and log in to an ECS, see Purchasing an ECS and Logging In to an ECS.
  2. Install the MongoDB client on the ECS. To ensure successful authentication, install the MongoDB client of the same version as the target instance.

    For details about how to install a MongoDB client, see How Can I Install a MongoDB Client?

  3. The ECS can communicate with the DDS instance. For details, see Configuring Security Group Rules.

Procedure

If you connect to an instance over the SSL connection, enable SSL first. Otherwise, an error is reported. For details about how to enable SSL, see Enabling and Disabling SSL.

  1. On the Instances page, click the instance name.
  2. In the navigation pane, choose Connections.
  3. In the Basic Information area, click next to the SSL field to download the root certificate.
  4. Upload the root certificate to the ECS that needs to connect to the instance.

    Choose the corresponding upload method based on whether the ECS runs Linux or Windows.

    • In Linux, run the following command:
      scp<IDENTITY_FILE><REMOTE_USER>@<REMOTE_ADDRESS>:<REMOTE_DIR>
      • IDENTITY_FILE indicates the directory where the root certificate is stored. Ensure that the directory's access permission is set to 600.
      • REMOTE_USER is the ECS OS user.
      • REMOTE_ADDRESS is the ECS address.
      • REMOTE_DIR is the directory on the ECS where the root certificate is uploaded.
    • In Windows, upload the root certificate using a remote connection tool.

  5. Connect to the instance. You are advised to use the read replica connection address provided on the DDS console to connect to the read replica.

    Command format:

    ./mongo "<Readonly_node_connection_address>" --ssl --sslCAFile<FILE_PATH> --sslAllowInvalidHostnames

    The parameters are explained as follows:

    • Readonly_node_connection_address: On the Instances page, click the instance name to go to the Basic Information page. Choose Connections in the navigation pane. Click the Private Connection tab and obtain the read replica connection address in the Address area.
      Figure 1 Obtaining the read replica connection address

      A read replica connection address is provided in the following format. The username rwuser and the authentication database admin are fixed and cannot be modified.

      mongodb://rwuser:<password>@192.168.xx.xx:8635,192.168.xx.xx:8635/test?authSource=admin&readPreference=secondaryPreferred&readPreferenceTags=role:readonly

      The following table lists the parameters in the read replica connection address.

      Table 1 Parameters

      Parameter

      Description

      rwuser

      Account name, that is, the database username.

      <password>

      Password for the database username. Replace it with the actual password.

      If the password contains at signs (@), exclamation marks (!), dollar signs ($), percent signs (%), or plus signs (+), replace them with hexadecimal URL codes (ASCII) %40, %21, %24, %25, and %2B, respectively.

      For example, if the password is ****@%***!$+, the corresponding URL code is ****%40%25***%21%24%2B.

      192.168.xx.xx:8635,192.168.xx.xx:8635

      IP address and port of the mongos node of the target cluster instance.

      test

      Name of the test database. Set this parameter as required.

      authSource=admin

      The authentication database of user rwuser must be admin. authSource=admin is fixed in the command.
    • FILE_PATH is the path where the root certificate is stored.
    • --sslAllowInvalidHostnames: To ensure that internal cluster communication does not consume user IP addresses or bandwidth resources, the cluster certificate is generated using the internal management IP address. You must add --sslAllowInvalidHostnames when connecting to a cluster instance over a private network using SSL.

    Command example:

    ./mongo "mongodb://rwuser:<password>@192.168.xx.xx:8635,192.168.xx.xx:8635/test?authSource=admin&readPreference=secondaryPreferred&readPreferenceTags=role:readonly" --ssl --sslCAFile /tmp/ca.crt --sslAllowInvalidHostnames

    When connecting to an instance using the read replica connection address, add double quotation marks (") before and after the connection string.

    Check the connection result. The connection is successful if the following information is displayed: 
    mongos>

If you connect to an instance over an unencrypted connection, disable SSL first. Otherwise, an error is reported. For details about how to disable SSL, see Enabling and Disabling SSL.

  1. Log in to the ECS.
  2. Connect to a DDS instance. The DDS console provides the read replica connection address. You can use this address to connect to the read replica.

    Example command:

    ./mongo "<Readonly_node_connection_address>"

    Readonly_node_connection_address: On the Instances page, click the instance name to go to the Basic Information page. Choose Connections. Click the Private Connection tab. In the Address area, obtain the connection address of the read replica.

    Figure 2 Obtaining the read replica connection address

    A read replica connection address is provided in the following format. The username rwuser and the authentication database admin are fixed and cannot be modified.

    mongodb://rwuser:<password>@192.168.xx.xx:8635,192.168.xx.xx:8635/test?authSource=admin&readPreference=secondaryPreferred&readPreferenceTags=role:readonly

    The following table lists the parameters in the private HA connection address.

    Table 2 Parameter description

    Parameter

    Description

    rwuser

    Account name, that is, the database username.

    <password>

    Password for the database account. Replace it with the actual password.

    If the password contains at signs (@), exclamation marks (!), dollar signs ($), percent signs (%), or plus signs (+), replace them with hexadecimal URL codes (ASCII) %40, %21, %24, %25, and %2B respectively.

    For example, if the password is ****@%***!$+, the corresponding URL code is ****%40%25***%21%24%2B.

    192.168.xx.xx:8635,192.168.xx.xx:8635

    IP address and port of the mongos node of the cluster instance to be connected.

    test

    The name of the test database. You can set this parameter based on your service requirements.

    authSource=admin

    The authentication database of user rwuser must be admin. authSource=admin is fixed in the command.

    Command example:

    ./mongo "mongodb://rwuser:<password>@192.168.xx.xx:8635,192.168.xx.xx:8635/test?authSource=admin&readPreference=secondaryPreferred&readPreferenceTags=role:readonly"

    If the following information is displayed, the instance is successfully connected: 
    mongos>

Helpful Links

Read Replica

Parent Topic: Connecting to a Cluster Instance over a Private Network