grantPrivilegesToRole
On this page
Definition
grantPrivilegesToRole
Assigns additional privileges to a user-defined role defined on the database on which the command is run.
Tip
In the
mongo
Shell, this command can also be run through thedb.grantPrivilegesToRole()
helper method.Helper methods are convenient for
mongo
users, but they may not return the same level of information as database commands. In cases where the convenience is not needed or the additional return fields are required, use the database command.The
grantPrivilegesToRole
command uses the following syntax:{ grantPrivilegesToRole: "<role>", privileges: [ { resource: { <resource> }, actions: [ "<action>", ... ] }, ... ], writeConcern: { <write concern> }, comment: <any> } The
grantPrivilegesToRole
command has the following fields:FieldTypeDescriptiongrantPrivilegesToRole
stringThe name of the user-defined role to grant privileges to.privileges
arrayThe privileges to add to the role. For the format of a privilege, seeprivileges
.writeConcern
documentOptional. The level of write concern for the modification. ThewriteConcern
document takes the same fields as thegetLastError
command.comment
anyOptional. A user-provided comment to attach to this command. Once set, this comment appears alongside records of this command in the following locations:
mongod log messages, in the
attr.command.cursor.comment
field.Database profiler output, in the
command.comment
field.currentOp
output, in thecommand.comment
field.
A comment can be any valid BSON type (string, integer, object, array, etc).
New in version 4.4.
Behavior
A role's privileges apply to the database where the role is created. A
role created on the admin
database can include privileges that apply
to all databases or to the cluster.
Required Access
You must have the grantRole
action on the database a privilege targets in order to
grant the privilege. To grant a privilege on multiple databases or on the
cluster
resource, you must have the grantRole
action on
the admin
database.
Example
The following grantPrivilegesToRole
command grants two
additional privileges to the service
role that exists in the
products
database:
use products db.runCommand( { grantPrivilegesToRole: "service", privileges: [ { resource: { db: "products", collection: "" }, actions: [ "find" ] }, { resource: { db: "products", collection: "system.js" }, actions: [ "find" ] } ], writeConcern: { w: "majority" , wtimeout: 5000 } } )
The first privilege in the privileges
array allows the user to
search on all non-system collections in the products
database. The
privilege does not allow queries on system collections, such as the system.js
collection. To grant access to these
system collections, explicitly provision access in the privileges
array. See Resource Document.
The second privilege explicitly allows the find
action on
system.js
collections on all
databases.