Users and roles in Managed Service for MongoDB

The data in Managed Service for MongoDB is handled on behalf of the cluster users. To differentiate user access rights, the role model is used. To assign specific access rights for the database to a user, you will need to grant them an appropriate role in this database.

Database user rolesDatabase user roles

These are regular roles available to any user database.

readread

Users with the read role have the read access to all non-system collections in the database and to the system.js collection. You can read more about this role in the MongoDB documentation.

readWritereadWrite

Users with the readWrite role have the write and read access to all non-system collections in the database and to the system.js collection. You can read more about this role in the MongoDB documentation.

mdbDbAdminmdbDbAdmin

Database administrator role. Grants the user the readWrite role permissions, as well as the permissions required for database administration:

• collMod
• planCacheWrite
• planCacheRead
• planCacheIndexFilter (which allows you to use the planCacheListFilters, planCacheClearFilters, and planCacheSetFilter commands)
• bypassDocumentValidation

Cluster administrator rolesCluster administrator roles

These roles are required for cluster monitoring and administration. They are assigned for the privileged MongoDB admin database.

mdbMonitormdbMonitor

This role is required for collecting statistics and monitoring. It grants the following permissions to the user:

• Working with the cluster:

  • connPoolStats
  • getLog
  • getParameter
  • getShardMap
  • hostInfo
  • inprog
  • listDatabases
  • listSessions
  • listShards
  • netstat
  • replSetGetConfig
  • replSetGetStatus
  • serverStatus
  • shardingState
  • top

• Working with all databases in the cluster:

  • collStats
  • dbStats
  • getShardVersion
  • indexStats
  • useUUID

• Working with all system.profile collections in all databases:

  • find

• Working with the system.indexes, system.js, and system.namespaces collections of the local and config databases:

  • collStats
  • dbHash
  • dbStats
  • find
  • killCursors
  • listCollections
  • listIndexes
  • planCacheRead

mdbShardingManagermdbShardingManager

This role is used for managing cluster sharding. It grants the following permissions to the user:

• Working with the admin database:

  • viewRole

• Working with any resource in the cluster:

  • enableSharding
  • flushRouterConfig
  • getShardVersion
  • getShardMap
  • shardingState
  • moveChunk
  • splitChunk
  • splitVector

• Working with the config database:

  • find