Mongodb Role-Based Access Control (Rbac) Explained
Mongodb Access Control Enables Database Administrators to Secure Mongodb Instances by Enforcing User Authentication. Mongodb Supports Multiple Authentication...
MongoDB access control enables database administrators to secure MongoDB instances by enforcing user authentication. MongoDB supports multiple authentication methods and grants access through role-based authorization.
Roles are the foundation blocks in MongoDB, providing user isolation for a great degree of security and manageability.
In this article, we’ll take a look at the most common roles in MongoDB. Then, we’ll explore role management by illustrating many common role-related functions.
(This article is part of our MongoDB Guide. Use the right-hand menu to navigate.)
How MongoDB RBAC works
A user can be assigned one or more roles, and the scope of user access to the database system is determined by those assigned roles. Users have no access to the system outside the designated roles.
Importantly, MongoDB access control is not enabled by default; you have to enable it through the security.authorization setting.
When that setting is enabled, users need to authorize themselves before interacting with the database. User privileges can include a specific resource (database, collection, cluster) and actions permitted on that resource.
A role grants permission to perform particular actions on a specific resource. A single user account can consist of multiple roles. Roles can be assigned:
- At the time of user creation
- When updating the roles of existing users
There are two types of Roles in MongoDB:
- Built-In Roles. MongoDB provides built-in roles to offer a set of privileges that are commonly needed in a database system.
- User-Defined Roles. If built-in roles do not provide all the expected privileges, database administrators can define custom roles using the createRole method. Those roles are called User-Defined roles.
Next, let’s look at the variety of roles in more details.
Built-in Roles
In this section, we’ll go through the most common built-in roles of MongoDB.
Database user roles
Database user roles are normal user roles that are useful in regular database interactions.
| Role | Description |
| read | Read all non-system collections and the system.js collection |
| readWrite | Both Read and Write functionality on non-system collections and the system.js collection |
Database administration roles
These are roles that are used to carry out administrative operations on databases.
| Role | Description |
| dbAdmin | Perform administrative tasks such as indexing and gathering statistics, but cannot manage users or roles |
| userAdmin | Provides the ability to create and modify roles and users of a specific database |
| dbOwner | This is the owner of the database who can perform any action. It is equal to combining all the roles mentioned above: readWrite, dbAdmin, and userAdmin roles |
Cluster admin roles
These roles enable users to interact and administrate MongoDB clusters.
| Role | Description |
| clusterManager | Enables management and monitoring functionality on the cluster. Provides access to config and local databases used in sharding and replication |
| clusterMonitor | Provide read-only access to MongoDB monitoring tools such as Cloud Manager or Ops Manager monitoring agent |
| hostManager | Provides the ability to monitor and manage individual servers |
| clusterAdmin | This role includes the highest number of cluster administrative privileges allowing a user to do virtually anything. This functionality is equal to the combination of clusterManager, clusterMonitor, hostManager roles, and dropDatabase action. |
Backup & restoration roles
These are the roles that are required for backup and restoring data in a MongoDB instance. They can only be assigned with the admin database.
| Role | Description |
| backup | Provides the necessary privileges to backup data. This role is required for MongoDB Cloud Manager and Ops Manager, backup agents, and the monogdump utility. |
| restore | Provides the privileges to carry out restoration functions |
All database roles
These are database roles that provide privileges to interact with all databases, excluding local and config databases.
| Role | Description |
| readAnyDatabase | Read any database |
| readWriteAnyDatabase | Provides read and write privileges to all databases |
| userAdminAnyDatabase | Create and Modify users and roles across all databases |
| dbAdminAnyDatabase | Perform database administrative functions on all databases |
Superuser roles
MongoDB can provide either direct or indirect system-wide superuser access. The following roles grant superuser privileges scoped to a specified database or databases.
- dbOwner
- userAdmin
- userAdminAnyDatabase
The true superuser role is the root role, which provides systemwide privileges for all functions and resources.
For a detailed explanation of all the user roles and privileges, please refer to the official MongoDB documentation.
Sophia analyzes international trade, startup ecosystems, retail transformation, and supply chain logistics for modern digital publications.
