📘 Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) in MongoDB provides fine-grained access control for your database. It allows you to grant users specific privileges on databases, collections, and operations.

Understanding RBAC Components

Roles

A role consists of:

• Privileges (actions allowed on resources)
• Roles (other roles from which this role inherits privileges)

MongoDB Atlas

Built-in Roles in Atlas

1. Organization Roles (examples)
   • Organization Owner
   • Organization Member
   • Organization Read Only

For all roles see this Documentation.

2. Project Roles (examples)
   • Project Owner
   • Project Data Access Admin
   • Project Data Access Read/Write
   • Project Read Only

For more project level roles see this Documentation.

Managing Roles in Atlas

## Using Atlas CLI to create a user with specific roles
atlas dbusers create \
  --username dataAdmin \
  --password "securePassword" \
  --role "readWrite@admin" \
  --projectId your-project-id

## Add additional roles
atlas dbusers update dataAdmin \
  --role "readAnyDatabase@admin" \
  --projectId your-project-id

Custom Roles Example

## Create a custom role for sales data access
atlas customDbRoles create <role-name> --inheritedRole read@salesDB --projectId {project_id}

## Assign a custom role
atlas dbusers create --username readOnlyUser --password readOnlyPass --role <role-name> --projectId {project_id}

On-Premises

Built-in Roles in MongoDB

1. Database User Roles

   • read
   • readWrite

2. Database Administration Roles

   • dbAdmin
   • dbOwner
   • userAdmin

3. Cluster Administration Roles

   • clusterAdmin
   • clusterManager
   • clusterMonitor
   • hostManager

Managing Roles

// Create an admin user
use admin
db.createUser({
  user: "dbAdmin",
  pwd: "securePassword",
  roles: [
    { role: "userAdmin", db: "admin" },
    { role: "dbAdmin", db: "admin" }
  ]
})

// Create application-specific roles
db.createRole({
  role: "applicationUser",
  privileges: [
    {
      resource: { db: "appDB", collection: "" },
      actions: [ "find", "insert", "update" ]
    }
  ],
  roles: []
})

Role Management Best Practices

MongoDB Atlas

1. Project-Level Access Control

   • Use Project roles for team-based access
   • Implement separate projects for development/production
   • Regular audit of project members

2. API Access

   • Use programmatic API keys with appropriate roles
   • Rotate API keys regularly
   • Monitor API key usage

Example:

// Create programmatic API key
atlas organizations apiKeys create \
  --desc "Application API Key" \
  --role ORG_MEMBER

On-Premises

1. Role Hierarchy

   • Design role hierarchy based on job functions
   • Use role inheritance to maintain consistency
   • Document role relationships

2. Monitoring and Auditing

   • Enable audit logging for role changes
   • Regular review of role assignments
   • Document all role modifications

Example:

// Enable audit logging
db.setParameter({
  auditAuthorizationSuccess: true
})

Practical Examples

MongoDB Atlas

Application-Specific Roles

// Create read-only analytics role
atlas customDBRoles create analyticsReader \
  --privilege '{ resource: { db: "analytics", collection: "" }, actions: ["find"] }' \
  --projectId your-project-id

 Custom role 'analyticsReader' successfully created.

// Assign role to user
atlas dbusers create \
  --username analyst \
  --password "securePassword" \
  --role analyticsReader \
  --projectId your-project-id

Database user 'analyst' successfully created.  

On-Premises

Application-Specific Roles

// Create a custom role for order processing
db.createRole({
  role: "orderProcessor",
  privileges: [
    {
      resource: { db: "sales", collection: "orders" },
      actions: [ "find", "insert", "update" ]
    },
    {
      resource: { db: "sales", collection: "customers" },
      actions: [ "find" ]
    }
  ],
  roles: []
})

// Assign role to user
db.createUser({
  user: "orderApp",
  pwd: "securePassword",
  roles: [ "orderProcessor" ]
})

Next Steps

After understanding RBAC, lets do a challenge to test our knowledge.