Authorization determines what an authenticated user or service may do, such as read, write, or administer resources. Authentication verifies identity; authorization sets permissions and access levels. section 20.3
Atlas and MongoDB use role-based access control (RBAC) to assign permissions:
- Roles define actions users may perform on resources. Privileges can be explicit or inherited; when users have multiple roles, the role with the greatest access level governs. section 20.3.3
- Built-in roles cover common needs: read for database queries, readWriteAnyDatabase for broad read/write access, clusterMonitor for monitoring, and atlasAdmin for cluster administration. section 20.3.3
- Custom roles can narrow permissions to the actions and resources each user or application needs, following the principle of least privilege. section 20.3.3
- Atlas Stream Processing extends access controls with task-specific roles and privileges, including permissions scoped to individual stream processing instances (SPIs). section 15.8
Role access takes precedence
A user with both read and readWriteAnyDatabase roles has write access because the latter grants the greater access level. section 20.3.3
atlas customDbRoles create customReadUpdateRole \ --privilege 'UPDATE@sample_training.routes' \ --privilege 'FIND@sample_supplies.sales'
Inspect an Atlas CLI example that creates a custom role with update and find privileges scoped to particular collections. section 20.3.3
