A role is a named set of privileges used to authorize actions after a user has authenticated. In MongoDB, a privilege permits an action on a resource such as a database or collection. A user without a database role has no database access. Assign only the permissions needed for the task to reduce the risk of unauthorized actions. section 20.3 section 20.3.3 section 2.7
First decide which kind of access you are granting. Atlas organization and project roles govern cloud-resource management: an organization owner can manage users, settings, and projects, while a project cluster manager can manage clusters without creating new ones. MongoDB database roles separately control actions within a cluster. Plan the organization and project hierarchy before assigning Atlas roles so permissions land at the intended level. section 20.3 section 20.3.2
For database access, choose the narrowest role that supports the work:
- Use read for queries against one database, or clusterMonitor for monitoring without changing data or settings. section 20.3.3
- Reserve readAnyDatabase, readWriteAnyDatabase, and atlasAdmin for work that genuinely needs their broader reach. section 20.3.3
- Create a custom role when built-in roles grant more access than necessary. Its privileges can be explicit or inherited from another role. section 20.3.3
Check the combined access of every role assigned to a user. A restrictive role does not cancel a broader one: a user with both read and readWriteAnyDatabase can still write. Atlas access can also be linked to identity-provider groups through identity federation. section 20.3.3 section 20.3
atlas customDbRoles create customReadUpdateRole \ --privilege 'UPDATE@sample_training.routes' \ --privilege 'FIND@sample_supplies.sales'
This Atlas CLI command creates a custom database role with UPDATE limited to sample_training.routes and FIND limited to sample_supplies.sales. section 20.3.3
atlas customDbRoles create readWriteAnalyticsRole \ --privilege 'INSERT@sample_analytics' \ --inheritedRole 'read@sample_analytics'
This alternative creates a role with an explicit INSERT privilege on sample_analytics and inherits that database’s read role. section 20.3.3
