Authorization

Introduction

Authorization decides what an authenticated identity is allowed to do. In MongoDB this is implemented with role-based access control (RBAC): every user is assigned one or more roles, and every role grants a set of privileges (actions × resources).

Authentication answers "who are you?". Authorization answers "what can you touch?". The two are independent — a user with valid credentials but no roles can connect and do absolutely nothing, which is exactly what you want.

Understanding the topic

MongoDB's RBAC model:

• Privilege = { resource, actions }. E.g. { db: "shop", collection: "orders" } + ["find", "insert"].
• Role = a named bundle of privileges. Built-in: read, readWrite, dbAdmin, clusterAdmin, backup, restore.
• User = identity + assigned roles, scoped to one or more databases.
• Custom roles let you grant exactly what an app needs (read all orders, write only audit logs).
• Atlas database roles map cluster roles to Atlas project-level access for cloud-native RBAC.

Informative example

Create a least-privilege application role and assign it to a service account:

// 1. Custom role: app can read products, write orders, never touch users.
db.adminCommand({
  createRole: "shopApp",
  privileges: [
    { resource: { db: "shop", collection: "products" }, actions: ["find"] },
    { resource: { db: "shop", collection: "orders"   }, actions: ["find", "insert", "update"] }
  ],
  roles: []
});

// 2. Service account using the role
db.getSiblingDB("shop").createUser({
  user: "checkout-svc",
  pwd: passwordPrompt(),
  roles: [{ role: "shopApp", db: "admin" }]
});

// 3. Verify
db.getSiblingDB("shop").runCommand({ rolesInfo: 1, showPrivileges: true });

Real-world use

Healthcare and fintech teams use custom roles to enforce HIPAA / SOX separation of duties: analysts get read on de-identified collections only, app services get scoped readWrite, and DBAs get cluster admin via short-lived federated credentials — never shared passwords.

Best practices

• Least privilege always. Never assign readWriteAnyDatabase to an app.
• One role per app, per environment. The staging app should not be able to write to prod.
• Rotate service-account passwords via secrets manager (Vault, AWS SM, Atlas API).
• Audit role assignments quarterly with db.getUsers() and Atlas access logs.

Common mistakes

• Granting dbOwner "just to get it working" — it never gets removed.
• Sharing one user between many microservices — you lose attribution in audit logs.
• Forgetting that __system role exists; never assign it to humans.