MongoDB：用户创建数据库需要哪些权限？

Question

We need to create a special role that will allow only the following actions:

1. Create a new database
2. Create a new user, which is admin for that database

Which MongoDB roles are needed to create a database? It is not written anywhere in the documentation here https://docs.mongodb.com/manual/reference/built-in-roles/ and it doesn't seem there is a known role which can perform this task

Answer 1

I think readWrite is the role you need. I tried what follows:

1. connect to my admin db using an administrative user
2. create a new aaa user, defined on admin db, with a password and two roles: readWrite on (not existent) database xxx and dbAdmin on (not existent) database yyy
3. connect to the admin db using aaa user

So I tried to insert a document in a test collection in both xxx and yyy databases:

use xxx
db.test.insert({})

with response Inserted 1 record(s) in 2ms

use yyy
db.test.insert({})

with response not authorized on yyy to execute command ...

The error message refers to the fact that aaa can't execute insert into test : database creation happens at the time of the first insert, so you need readWrite role in order to make the first insert ==> create the database.

I hope the approach I adopted to check the question can help you resolving your problem.