MongoDB / Document DB Privilege Type Mapping
The privilege types for each MongoDB and Document DB statement are mapped as shown in the table below.
| Category | Privilege Type | MongoDB / Document DB |
|---|---|---|
| DML | Select | ~.find(), ~.findOne(), general ~.aggregate() |
| DML | Select + Delete | ~.findOneAndDelete(), findAndModify { remove: true } |
| DML | Select + Update | ~.findOneAndUpdate(), ~.findOneAndReplace(), findAndModify { update: ... }Adds Insert when upsert: true |
| DML | Update | ~.update(), ~.updateOne(), ~.updateMany(), ~.replaceOne() Adds Insert when upsert: true |
| DML | Insert + Create | ~.insert(), ~.insertOne(), ~.insertMany() Adds Create when the target collection does not exist |
| DML | Select + Insert + Update | Final aggregate stage: $merge Adds Create when the target collection does not exist |
| DML | Select + Insert + Create + Rename + Delete | Final aggregate stage: $out |
| DCL | Grant | db.grantRolesToUser(), db.grantRolesToRole(), db.grantPrivilegesToRole() |
| DCL | Revoke | db.revokeRolesFromUser(), db.revokeRolesFromRole(), db.revokePrivilegesFromRole() |
| DCL | Alter | db.updateUser() |
| DCL | Update | db.updateRole() |
| DDL | Create | ~.createIndex(), ~.createIndexes(), db.createCollection(), db.createView(), db.createUser(), db.createRole() |
| DDL | Drop | ~.drop(), db.dropDatabase(), db.dropUser(), db.dropAllUsers(), db.dropRole(), db.dropAllRoles() |
| DDL | Rename | ~.renameCollection() |
| Others | Etc. | ~.commitTransaction(), ~.abortTransaction(), ~.startTransaction() |
Example of creating a Privilege Type
Last updated on