Role-based access control (RBAC) determines what an authenticated user can do. Atlas roles govern actions in an organization or project; MongoDB database roles govern actions on databases and collections. Authentication establishes identity, while authorization uses assigned roles to allow operations such as reading, writing, or administration. section 20.3
A database role grants privileges on resources, either directly or through an inherited role. A user with no role has no database access. When a user has multiple roles, a broader grant can permit actions that a narrower role alone would not—for example, readWriteAnyDatabase permits writes even when the user also has a read role. section 20.3.3
Choose the narrowest role that fits the job:
- Use read for queries against one database, or readAnyDatabase when read access must span databases. section 20.3.3
- Use readWriteAnyDatabase only when broad read and write access is needed; reserve atlasAdmin for cluster administration and clusterMonitor for monitoring. section 20.3.3
- Create a custom role when built-in roles grant more access than an application or user needs. section 20.3.3
atlas customDbRoles create customReadUpdateRole \ --privilege 'UPDATE@sample_training.routes' \ --privilege 'FIND@sample_supplies.sales'
This Atlas CLI command creates a custom database role with UPDATE on sample_training.routes and FIND on sample_supplies.sales, rather than granting broad database-wide access. section 20.3.3
atlas customDbRoles create readWriteAnalyticsRole \ --privilege 'INSERT@sample_analytics' \ --inheritedRole 'read@sample_analytics'
This alternative creates a role with INSERT on sample_analytics and inherits that database’s read role. Inheritance lets a custom role combine an explicit privilege with an existing role. section 20.3.3
Give each application a dedicated user or service account so permissions stay isolated and actions are easier to track. RBAC is one layer of defense: authenticate connections, restrict network access, and use auditing to monitor access alongside it. section 20.8 section 20.7
