MongoDB Security: How to Set Up Role-Based Access Control

In today’s data-driven applications, managing who has access to what within your database is a critical aspect of maintaining security, integrity, and compliance. Role-Based Access Control (RBAC) is a security model that allows you to manage user access by assigning permissions to roles rather than directly to users. MongoDB, as a leading NoSQL database, offers a robust RBAC implementation that allows administrators to define roles with specific privileges and assign those roles to users as needed. This ensures that users only have access to the data and operations necessary for their responsibilities — a fundamental principle known as least privilege access.

What is RBAC?

RBAC or role-based access control is a security mechanism based on the design principle of least privilege. RBAC is not an authentication mechanism, but a security mechanism to manage access after a user has been authenticated.

In RBAC, a user can play one or more roles, defined based on organizational policies. A role can have multiple privileges (permissions). Each permission can impact multiple capabilities. Let us understand this with an example.

Consider a customer service representative (User) gets a call from a customer to check if a new service on his SIM is activated or not. The user needs to access all the customer data, including his phone details, personal details, etc.

However, he just wants to view the information, so his “role” could be that of a “viewer.”

A viewer need not have privileges to modify information in the database, hence his permissions could be “read-only” as per the policy.

Finally, let’s say that the customer’s phone details are stored in one database and personal details are on a different database—in which case, he needs permissions for both databases. This defines the role’s capabilities, i.e., which part of the database can or cannot be accessed.

Key components in MongoDB’s RBAC:

• Users: These are the accounts that authenticate to the database. Each user is tied to a specific authentication database (often “admin”) and can be assigned roles.
• Roles: A role is a named collection of privileges. MongoDB provides built-in roles (e.g., read for viewing data) and allows custom roles for tailored access.
• Privileges: These define specific actions (e.g., find to query documents, insert to add data) on resources (e.g., a database, collection, or cluster).
• Inheritance: Roles can inherit privileges from other roles, creating hierarchies (e.g., a “manager” role inherits from an “analyst” role).

Unlike authentication (which verifies who you are, via mechanisms like SCRAM or certificates), RBAC controls what you can do after logging in.

RBAC models

There are several RBAC models developed based on the core model, which is the foundational model of a RBAC system. As per the core model, users can be assigned multiple roles, and each role can have a specific set of privileges or permissions, to access certain capabilities.

MongoDB implements core elements of the NIST RBAC standard:

• Core RBAC: Users are assigned roles, and roles grant privileges.
• Hierarchical RBAC: Roles can inherit from others, allowing “senior” roles to include junior ones without duplication.
• Constrained RBAC: While not native, you can approximate constraints like separation of duties (e.g., preventing a user from both creating and approving records) through custom role design and application logic.

MongoDB doesn’t natively support dynamic constraints (e.g., time-based access), but you can integrate with external systems like LDAP or use MongoDB Atlas for features like temporal roles.

Why Use RBAC in MongoDB?

RBAC provides numerous advantages in both operational efficiency and security:

Security:

Prevents unauthorized access and limits damage from compromised accounts.

Compliance:

Supports standards like GDPR, HIPAA, PCI-DSS, and SOC 2 by enabling auditing and fine-grained controls.

Efficiency:

Reusable roles simplify onboarding and offboarding users.

Scalability:

Ideal for microservices, multi-tenant apps, or distributed teams.

Steps to Set Up RBAC in MongoDB

Before diving into RBAC, ensure MongoDB is installed. This guide assumes MongoDB  Community Edition on Linux, Download from the official site and verify with mongod –version.

Key Prerequisite: By default, MongoDB runs without authentication enabled—a common beginner mistake leading to open access. Always enable it in production.

Implementing RBAC in MongoDB involves a few key steps. Here’s how to do it effectively:

1. Enable Access Control

By default, MongoDB does not enforce authentication. To enable it:

• Open your MongoDB configuration file (usually mongod.conf).

Add or update the following lines:

security:
  authorization: enabled

Restart the MongoDB service:

sudo systemctl restart mongod

This tells MongoDB to enforce RBAC. Test by trying to connect without credentials—you should get an authentication error.

Common Mistake Correction:

Forgetting to create an admin user before enabling authorization can lock you out. Connect unauthenticated first to set it up.

2. Create the First Admin User

Before you restrict access, you need to create an initial administrative user who can manage the system:

Before restarting with authorization, connect locally (mongo) and create a superuser in the admin database. This user will manage other users and roles.

use admin;
db.createUser({
  user: "superAdmin",
  pwd: passwordPrompt(),  // Securely prompts for password
  roles: [
	{ role: "userAdminAnyDatabase", db: "admin" },  // Manage users
	{ role: "dbAdminAnyDatabase", db: "admin" },	// Database admin tasks
	{ role: "readWriteAnyDatabase", db: "admin" },  // Data access
	{ role: "clusterAdmin", db: "admin" }       	// Cluster management
  ]
});

Authenticate as Admin

Once the admin is created and auth is enabled, you’ll need to authenticate for further operations:

mongosh -u "superAdmin" -p --authenticationDatabase "admin"

Why passwordPrompt()?

This method, available in mongosh (MongoDB 4.4+), prompts for the password interactively, preventing it from appearing in shell history (e.g., ~/.mongosh_history) or logs, unlike hardcoding pwd: “MyPassword”. You’ll enter the password (e.g., “SecureComplexPass2025!”) at the prompt, and MongoDB hashes it securely using SCRAM-SHA-256.

• The admin database is the central hub for global roles. Always define admin users here.
•  Specify mechanisms: [“SCRAM-SHA-256”] for stronger authentication. Use TLS (net.tls.mode: requireTLS) to encrypt network traffic.

3. Create Application Users with Specific Roles

Now you can create regular users with appropriate privileges for your application:

Switch to your application database:

use myAppDatabase;

Read-Only User:

db.createUser({
  user: "dataViewer",
  pwd: passwordPrompt(),  // Secure password entry
  roles: [{ role: "read", db: "myAppDatabase" }]
});

Read-Write User:

db.createUser({
  user: "dataEditor",
  pwd: passwordPrompt(),  // Secure password entry
  roles: [{ role: "readWrite", db: "myAppDatabase" }]
});

Use db.updateUser() to modify roles or rotate passwords without recreating users.

4. Use Built-in Roles

MongoDB offers several built-in roles for common use cases:

Role	Key Privileges	Use Case
read	Query data, run aggregations	Reporting tools, analysts
readWrite	Read + insert, update, delete	Application backends
dbAdmin	Manage indexes, schemas	DB maintenance
userAdmin	Create/update users and roles	Limited admin access
clusterAdmin	Manage replicas, shards	Ops teams in clusters
readWriteAnyDatabase	Read/write across all databases	Backup scripts, migrations

5. Create Custom Roles (Optional)

When built-in roles aren’t specific enough, you can define custom roles:

Example: A user who can only insert into a specific collection:

use myAppDatabase;
db.createRole({
  role: "orderInserter",
  privileges: [
	{
  	resource: { db: "myAppDatabase", collection: "orders" },
  	actions: ["insert", "find"]  // Allow adding and viewing orders
	}
  ],
  roles: [{ role: "read", db: "myAppDatabase" }]  // Inherit read access
});
db.createUser({
  user: "orderProcessor",
  pwd: passwordPrompt(),  // Secure password entry
  roles: [{ role: "orderInserter", db: "myAppDatabase" }]
});

Beginner Tip: Use actions like update or remove for specific operations. Resources can target collections or use wildcards ({ collection: “” }).

Advanced: Add actions like bypassDocumentValidation for schema flexibility or collMod for collection changes. Define roles on admin for cluster-wide scope.

6. Verify Access and Roles

To check if a user has the correct roles and access, use:

db.runCommand({ connectionStatus: 1 })

This shows the current authenticated user’s roles and databases.

List users and roles:

db.getUsers();
db.getRoles({ showPrivileges: true });

Update a user:

db.updateUser("dataViewer", {
  pwd: passwordPrompt(),  // Securely update password
  roles: [{ role: "readWrite", db: "myAppDatabase" }]
});

 Best Practices

• Secure Passwords: Use passwordPrompt() for interactive user creation to avoid cleartext in history.
• Account Hygiene: Regularly audit with db.getUsers() and revoke with db.revokeRolesFromUser().
• Encryption: Enable TLS (net.tls.mode: requireTLS) for secure connections.
• Least Privilege: Start with minimal roles and expand as needed.
• Backups: Export roles with mongodump –db admin.
• Monitoring: Use MongoDB Ops Manager or Atlas for alerts and auditing.

Conclusion

Role-Based Access Control (RBAC) is a fundamental feature for securing MongoDB deployments. It ensures that users can only perform actions that are explicitly authorized, reducing the risk of data leaks, mismanagement, or insider threats. By enabling authentication, creating administrative and application users, using built-in or custom roles, and following security best practices, you can effectively manage access to your MongoDB environment. Whether you’re developing a simple application or managing a production-scale cluster, implementing RBAC is a best practice you can’t afford to overlook.