How to build an authenticated srv connection string?

[weberc2-tempus]

Hello, I'm creating a mongodbatlas_database_user for my application and I'm trying to figure out how to pass my application an authenticated connection string to use, but I can't figure out how to get the host to use to build the connection string. I'm trying something like this:

resource "random_password" "app_mongo_user" {
  length  = 15
  special = true
}

resource "mongodbatlas_database_user" "app" {
  username   = "app"
  password   = random_password.app_mongodb_user.result
  project_id = mongodbatlas_project.this.id

  auth_database_name = "admin"

  roles {
    role_name     = "readWrite"
    database_name = local.mongo_database_name
  }

  scopes {
    name = mongodbatlas_cluster.this.name
    type = "CLUSTER"
  }
}

resource "kubernetes_secret" "app_mongo" {
  metadata {
    name      = "app-mongo"
    namespace = module.workload_context.namespace
  }

  data = {
    MONGO_CONNECTION_STRING = "mongodb+srv://${mongodbatlas_database_user.app.id}:${urlencode(random_password.app_mongodb_user.result)}@${WHAT_GOES_HERE}?retryWrites=true&w=majority"
  }
}

For the WHAT_GOES_HERE placeholder, I'm looking at trying to parse it out of mongodbatlas_cluster.connection_strings.0.standard_srv but that seems really complicated so I assume I must be missing something?