Skip to content

Commit b353594

Browse files
corryrootcorryroot
authored
(DOCSP-32350): Revamped Users and Roles tutorial. (#4874)
* (DOCSP-32350): Revamped Users and Roles tutorial. * (DOCSP-32350): Incorporated Sarah's feedback. * (DOCSP-32350): Incorporated Jack's feedback. * (DOCSP-32350): Incorporated Jack's feedback.
1 parent 3e29e51 commit b353594

File tree

4 files changed

+538
-72
lines changed

4 files changed

+538
-72
lines changed

‎snooty.toml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,13 @@ sbe-title = "Slot-Based Query Execution Engine"
241241
version = "{+version+}"
242242
version-last = "{+version-last+}"
243243
year = "2022"
244+
ui-org-menu = ":icon-mms:`office` :guilabel:`Organizations` menu"
245+
244246
[constants]
247+
atlas-admin-api = "Atlas Administration API"
248+
atlas-cli = "Atlas CLI"
249+
atlas-ui = "Atlas UI"
250+
mongosh = ":binary:`~bin.mongosh`"
245251
package-branch = "testing" # testing for dev rc releases
246252
windows-dir-version = "6.0" # wizard
247253
package-name-org = "mongodb-org"

‎source/includes/atlas-user-defined-roles.rst

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
.. _add-custom-role-atlas:
2+
3+
Add a Custom User-Defined Role in {+atlas+}
4+
-----------------------------------------------
5+
6+
You can create custom user-defined roles in {+atlas+} when the
7+
:ref:`built-in roles <atlas-user-privileges>` don't include your
8+
desired set of privileges. To learn more see,
9+
:atlas:`Add Custom Roles
10+
</security-add-mongodb-roles/#add-custom-roles>` in the {+atlas+}
11+
documentation.
12+
13+
.. See https://www.mongodb.com/docs/atlas/security-add-mongodb-roles/#add-custom-roles for source material.
14+
15+
.. tabs::
16+
17+
.. tab:: {+atlas-cli+}
18+
:tabid: atlascli
19+
20+
To create a custom database role for your project using the
21+
{+atlas-cli+}, run the following command:
22+
23+
.. code-block:: sh
24+
25+
atlas customDbRoles create <roleName> [options]
26+
27+
To learn more about the command syntax and parameters, see
28+
the {+atlas-cli+} documentation for
29+
:atlascli:`atlas customDbRoles create
30+
</command/atlas-customDbRoles-create/>`.
31+
32+
.. tab:: {+atlas-admin-api+}
33+
:tabid: api
34+
35+
To create custom roles through the {+atlas-admin-api+},
36+
see :oas-atlas-op:`Create One Custom Role
37+
</createCustomDatabaseRole>`.
38+
39+
.. tab:: {+atlas-ui+}
40+
:tabid: ui
41+
42+
Follow these steps to create a custom role through the
43+
{+atlas-ui+}:
44+
45+
.. procedure::
46+
:style: normal
47+
48+
.. step:: Open the :guilabel:`Add Custom Role` dialog
49+
50+
a. In the :guilabel:`Security` section of the left
51+
navigation, click :guilabel:`Database Access`.
52+
53+
#. Click the :guilabel:`Custom Roles` tab.
54+
55+
#. Click :icon-fa5:`plus`
56+
:guilabel:`Add New Custom Role`.
57+
58+
.. step:: Enter the information for the custom role
59+
60+
.. list-table::
61+
:widths: 20 80
62+
:header-rows: 1
63+
64+
* - Field
65+
66+
- Description
67+
68+
* - :guilabel:`Custom Role Name`
69+
70+
- Name of your custom role.
71+
72+
* - :guilabel:`Action or Role`
73+
74+
- Privileges granted by the role. Click the
75+
drop-down menu to view the list of available
76+
:manual:`privilege actions
77+
</reference/privilege-actions/>` and
78+
:manual:`roles </reference/built-in-roles/>`.
79+
80+
{+atlas+} groups the actions and roles into
81+
the following categories:
82+
83+
- ``Collection Actions``
84+
- ``Database Actions and Roles``
85+
- ``Global Actions and Roles``
86+
- ``Custom Roles`` (if any)
87+
88+
Select the action or role from a single
89+
category. Once you select an action or role,
90+
{+atlas+} disables the other categories with
91+
the following exception. If you select an
92+
action or role from the
93+
:guilabel:`Global Actions and Roles`, you can
94+
still select actions/roles from
95+
:guilabel:`Custom Roles`.
96+
97+
To grant actions and roles from a different
98+
category, click :guilabel:`Add an action or role` to
99+
add a new row.
100+
101+
* - :guilabel:`Database`
102+
103+
- Database on which the selected actions and
104+
roles are granted, if applicable.
105+
106+
{+atlas+} requires this field for all roles
107+
and actions under the
108+
:guilabel:`Collection Actions` and
109+
:guilabel:`Database Actions and Roles`
110+
categories.
111+
112+
* - :guilabel:`Collection`
113+
114+
- Collection within the specified database on
115+
which the actions and roles are granted, if
116+
applicable.
117+
118+
{+atlas+} requires this field for all roles
119+
and actions under
120+
:guilabel:`Collection Actions`.
121+
122+
To grant the same set of privileges on
123+
multiple databases and collections, click
124+
:guilabel:`Add a database or collection`.
125+
126+
.. step:: Click :guilabel:`Add Custom Role`

‎source/includes/self-managed-user-defined-roles.rst

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
.. _define-roles-prereq:
2+
3+
Prerequisites
4+
-------------
5+
6+
.. include:: /includes/access-create-role.rst
7+
8+
To add custom user-defined roles with {+mongosh+}, see the
9+
following examples:
10+
11+
- :ref:`create-role-to-manage-ops`.
12+
- :ref:`create-role-for-mongostat`.
13+
- :ref:`create-role-for-system-views`.
14+
15+
.. _create-role-to-manage-ops:
16+
17+
Create a Role to Manage Current Operations
18+
------------------------------------------
19+
20+
The following example creates a role named ``manageOpRole`` which
21+
provides only the privileges to run both :method:`db.currentOp()`
22+
and :method:`db.killOp()`. [#built-in-roles1]_
23+
24+
.. note::
25+
26+
Starting in MongoDB 3.2.9, users do not need any specific
27+
privileges to view or kill their own operations on
28+
:binary:`~bin.mongod` instances. See :method:`db.currentOp()`
29+
and :method:`db.killOp()` for details.
30+
31+
.. include:: /includes/steps/create-role-manage-ops.rst
32+
33+
.. [#built-in-roles1]
34+
The built-in role :authrole:`clusterMonitor` also provides the
35+
privilege to run :method:`db.currentOp()` along with other
36+
privileges, and the built-in role :authrole:`hostManager`
37+
provides the privilege to run :method:`db.killOp()` along with
38+
other privileges.
39+
40+
.. _create-role-for-mongostat:
41+
42+
Create a Role to Run ``mongostat``
43+
----------------------------------
44+
45+
The following example creates a role named ``mongostatRole`` that
46+
provides only the privileges to run :binary:`~bin.mongostat`.
47+
[#built-in-roles2]_
48+
49+
.. include:: /includes/steps/create-role-mongostat.rst
50+
51+
.. [#built-in-roles2] The built-in role
52+
:authrole:`clusterMonitor` also provides the privilege to run
53+
:binary:`~bin.mongostat` along with other
54+
privileges.
55+
56+
.. _create-role-for-system-views:
57+
58+
Create a Role to Drop ``system.views`` Collection across Databases
59+
------------------------------------------------------------------
60+
61+
The following example creates a role named
62+
``dropSystemViewsAnyDatabase`` that provides the privileges to
63+
drop the ``system.views`` collection in any database.
64+
65+
.. include:: /includes/steps/create-role-dropSystemViews.rst

0 commit comments

Comments
 (0)