A custom role defines only the MongoDB privileges a user or application needs instead of relying solely on broader built-in roles. It supports the principle of least privilege by narrowing access to particular actions, databases, or collections. section 20.3.3 section 20.8
Choose the role scope deliberately:
- Create the role in the admin database when it must be available across the MongoDB instance, such as for administrators or developers working across multiple databases. section 20.3.3
- Create the role in a specific application database when access must remain limited to that database, such as for an application service. section 20.3.3
- Keep non-admin roles constrained to privileges for their own database and inherit only from roles within that same database. section 20.3.3
- Prefer custom roles when built-in roles are broader than necessary, temporary project access is required, or regulations demand strict data-exposure controls. section 20.3.3
atlas customDbRoles create customReadUpdateRole \ --privilege 'UPDATE@sample_training.routes' \ --privilege 'FIND@sample_supplies.sales'
Assign narrowly targeted privileges to named collections, such as UPDATE on routes and FIND on sales. section 20.3.3
atlas customDbRoles create readWriteAnalyticsRole \ --privilege 'INSERT@sample_analytics' \ --inheritedRole 'read@sample_analytics'
Combine a direct privilege with an inherited read role to build a role for analytics work. section 20.3.3
customRoleName INSERT N/A sample_analytics ALL COLLECTIONS customRoleName N/A read sample_analytics N/A customReadUpdateRole UPDATE N/A sample_training routes customReadUpdateRole FIND N/A sample_supplies sales
Review the resulting privilege and inheritance mapping across databases and collections. section 20.3.3
Use dedicated users or service accounts with custom roles rather than shared accounts. This isolates permissions, improves action tracking, and reduces the damage caused by misuse or errors. section 20.8
