| The admin database includes the following roles for backing up and
restoring data: backupProvides minimal privileges needed for backing up data. This role
provides sufficient privileges to use the MongoDB Cloud Manager backup agent,
Ops Manager backup agent, or to use
mongodump to back up an entire mongod instance. Provides the update actions
on the settings collection in the
config database. On cluster as a whole, provides the
restoreProvides convertToCapped on non-system collections. Provides the necessary privileges to restore data from backups if the data
does not include system.profile collection
data and you run --oplogReplay option. If the backup data includes system.profile collection data or you run with
--oplogReplay, you need
additional privileges: | If the backup data includes system.profile collection data and the target database
does not contain the system.profile
collection, mongorestore attempts to create the collection
even though the program does not actually restore system.profile
documents. As such, the user requires additional privileges to perform
convertToCapped
actions on the system.profile
collection for a database. Both the built-in roles dbAdmin and
dbAdminAnyDatabase provide the additional privileges. | | |
Provides the following action on the cluster as a whole: Provides the following actions on system.js collection: Provides the following actions on all non-system collections on the
config and the local databases: Provides the following actions on admin.system.users
and legacy system.users collections: Although, restore includes the ability to modify the
documents in the admin.system.users collection using normal
modification operations, only modify these data using the
user management methods. Provides the following action on the <database>.system.views
collection: On the cluster as a whole, provides the
following actions:
The following roles are available on the admin database and provide
privileges which apply to all databases except local and
config: readAnyDatabaseProvides the same read-only privileges as read on all databases
except local and config. The role also provides the
listDatabases action on the cluster as a whole. See also the clusterManager and
clusterMonitor roles for access to the config and
local databases.
readWriteAnyDatabaseProvides the same privileges as readWrite on
all databases except local and config. The role also
provides: See also the clusterManager and
clusterMonitor roles for access to the config and
local databases.
userAdminAnyDatabaseProvides the same access to user administration operations as
userAdmin on all databases except local and
config. userAdminAnyDatabase also provides the
following privilege actions on the cluster:
The role provides the following privilege actions on the
system.users and
system.roles collections on the
admin database, and on legacy system.users collections from
versions of MongoDB prior to 2.6: The userAdminAnyDatabase role does not restrict the privileges
that a user can grant. As a result, userAdminAnyDatabase users
can grant themselves privileges in excess of their current
privileges and even can grant themselves all privileges, even though the
role does not explicitly authorize privileges beyond user administration.
This role is effectively a MongoDB system superuser. See also the clusterManager and
clusterMonitor roles for access to the config and
local databases.
dbAdminAnyDatabaseProvides the same privileges as dbAdmin on
all databases except local and config. The role also
provides the listDatabases action on the cluster as
a whole. See also the clusterManager and
clusterMonitor roles for access to the config and
local databases. Starting in MongoDB 5.0, dbAdminAnyDatabase includes the
applyOps privilege action.
Several roles provide either indirect or direct system-wide superuser access. The following roles provide the ability to assign any user any privilege on
any database, which means that users with one of these roles can assign
themselves any privilege on any database: The following role provides full privileges on all resources: rootProvides access to the operations and all the resources of the
following roles combined: Also provides the following privilege actions: Changed in version 6.0: The root role includes find and
remove privileges on the system.preimages
collection in the config database.
__systemMongoDB assigns this role to user objects that represent cluster members,
such as replica set members and mongos instances. The role
entitles its holder to take any action against any object in the database. Do not assign this role to user objects representing applications or
human administrators, other than in exceptional circumstances. If you need access to all actions on all resources, for example to
run applyOps commands, do not assign this role.
Instead, create a user-defined role that
grants anyAction on anyResource and
ensure that only the users who need access to these operations have
this access.
|
