grantPrivilegesToRole (original) (raw)

grantPrivilegesToRole

Assigns additional privileges to a user-defined role defined on the database on which the command is run.

Tip

In mongosh, this command can also be run through the db.grantPrivilegesToRole() helper method.

Helper methods are convenient for mongosh users, but they may not return the same level of information as database commands. In cases where the convenience is not needed or the additional return fields are required, use the database command.

The grantPrivilegesToRole command uses the following syntax:


db.runCommand(

   {

     grantPrivilegesToRole: "<role>",

     privileges: [

       {

         resource: { <resource> }, actions: [ "<action>", ... ]

       },

       ...

     ],

     writeConcern: { <write concern> },

     comment: <any>

   }

)

This command is available in deployments hosted in the following environments:

MongoDB Atlas: The fully managed service for MongoDB deployments in the cloud

Important

This command is not supported in M0, M2, M5, and Flex clusters. For more information, see Unsupported Commands.

MongoDB Enterprise: The subscription-based, self-managed version of MongoDB
MongoDB Community: The source-available, free-to-use, and self-managed version of MongoDB

The command has the following fields:

Field	Type	Description
grantPrivilegesToRole	string	The name of the user-defined role to grant privileges to.
privileges	array	The privileges to add to the role. For the format of a privilege, seeprivileges.
writeConcern	document	Optional. The level of write concern for the operation. See Write Concern Specification.
comment	any	Optional. A user-provided comment to attach to this command. Once set, this comment appears alongside records of this command in the following locations:mongod log messages, in theattr.command.cursor.comment field.Database profiler output, in the command.comment field.currentOp output, in the command.comment field.A comment can be any valid BSON type(string, integer, object, array, etc).

A role's privileges apply to the database where the role is created. A role created on the admin database can include privileges that apply to all databases or to the cluster.

You must have the grantRole action on the database a privilege targets in order to grant the privilege. To grant a privilege on multiple databases or on thecluster resource, you must have the grantRole action on the admin database.

The following grantPrivilegesToRole command grants two additional privileges to the service role that exists in theproducts database:


use products

db.runCommand(

   {

     grantPrivilegesToRole: "service",

     privileges: [

         {

           resource: { db: "products", collection: "" }, actions: [ "find" ]

         },

         {

           resource: { db: "products", collection: "system.js" }, actions: [ "find" ]

         }

     ],

     writeConcern: { w: "majority" , wtimeout: 5000 }

   }

)

The first privilege in the privileges array allows the user to search on all non-system collections in the products database. The privilege does not allow queries on system collections, such as the system.js collection. To grant access to these system collections, explicitly provision access in the privilegesarray. See Resource Document on Self-Managed Deployments.

The second privilege explicitly allows the find action onsystem.js collections on all databases.