Skip to content

Commit cd970b1

Browse files
gmiller-mdbgmiller-mdb
authored
DOCSP-47109-document-minimum-privileges (#650) (#653)
* DOCSP-47109-DOCSP-document-minimum-privileges * table stuff * table format * fix build error * spacing * actual spacing * changed spacing to 3 * re doing all of the spaces god * feedback (cherry picked from commit b907945)
1 parent 8018e80 commit cd970b1

File tree

3 files changed

+352
-3
lines changed

3 files changed

+352
-3
lines changed

‎source/includes/minimum-destination-privileges.rst

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
.. list-table::
2+
:header-rows: 1
3+
:stub-columns: 1
4+
:widths: 10 20
5+
6+
* - Sync Type
7+
- Minimum Destination Privileges
8+
9+
* - Default
10+
- .. code-block:: javascript
11+
12+
[
13+
{
14+
"resource": { "cluster": true },
15+
"actions": [
16+
"appendOplogNote",
17+
"enableSharding",
18+
"getDefaultRWConcern",
19+
"getShardMap",
20+
"hostInfo",
21+
"listDatabases",
22+
"listShards",
23+
"replSetGetConfig",
24+
"replSetGetStatus",
25+
"serverStatus"
26+
]
27+
},
28+
{
29+
"resource": { "db": "", "collection": "" },
30+
"actions": [
31+
"bypassDocumentValidation",
32+
"changeStream",
33+
"collMod",
34+
"convertToCapped",
35+
"createCollection",
36+
"createIndex",
37+
"dropCollection",
38+
"dropIndex",
39+
"enableSharding",
40+
"find",
41+
"indexStats",
42+
"insert",
43+
"listCollections",
44+
"listIndexes",
45+
"remove",
46+
"renameCollectionSameDB",
47+
"update",
48+
"bypassWriteBlockingMode",
49+
"setUserWriteBlockMode"
50+
]
51+
},
52+
{
53+
"resource": { "db": "admin", "collection": "system.version" },
54+
"actions": [ "find" ]
55+
},
56+
{
57+
"resource": { "db": "", "collection": "system.js" },
58+
"actions": [ "listCollections", "listIndexes" ]
59+
},
60+
{
61+
"resource": { "db": "config", "collection": "shards" },
62+
"actions": [ "find" ]
63+
},
64+
{
65+
"resource": { "db": "", "collection": "system.views" },
66+
"actions": [ "dropCollection" ]
67+
},
68+
{
69+
"resource": { "db": "config", "collection": "version" },
70+
"actions": [ "find" ]
71+
},
72+
{
73+
"resource": { "db": "config", "collection": "collections" },
74+
"actions": [ "find" ]
75+
},
76+
{
77+
"resource": { "db": "config", "collection": "settings" },
78+
"actions": [ "find" ]
79+
},
80+
{
81+
"resource": { "db": "config", "collection": "tags" },
82+
"actions": [ "find" ]
83+
},
84+
{
85+
"resource": { "system_buckets": "" },
86+
"actions": [ "listCollections", "listIndexes" ]
87+
}
88+
]
89+
90+
* - Write Blocking
91+
- Everything from the default destination privileges.
92+
93+
* - Reversing
94+
- Everything from the default source privileges and the default destination
95+
privileges with the addition of:
96+
97+
.. code-block:: javascript
98+
99+
[
100+
{ "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
101+
]
102+
103+
* - Multiple Reversals
104+
- Everything from the default source privileges and the default destination
105+
privileges with the addition of:
106+
107+
.. code-block:: javascript
108+
109+
[
110+
{ "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
111+
]
112+

‎source/includes/minimum-source-privileges.rst

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
.. list-table::
2+
:header-rows: 1
3+
:stub-columns: 1
4+
:widths: 10 30
5+
6+
* - Sync Type
7+
- Minimum Source Privileges
8+
9+
* - Default
10+
- .. code-block:: javascript
11+
12+
[
13+
{
14+
"resource": { "cluster": true },
15+
"actions": [
16+
"appendOplogNote",
17+
"getDefaultRWConcern",
18+
"getShardMap",
19+
"hostInfo",
20+
"listDatabases",
21+
"listShards",
22+
"replSetGetConfig",
23+
"replSetGetStatus",
24+
"serverStatus"
25+
]
26+
},
27+
{
28+
"resource": { "db": "", "collection": "" },
29+
"actions": [
30+
"changeStream",
31+
"collStats",
32+
"find",
33+
"indexStats",
34+
"listCollections",
35+
"listIndexes"
36+
]
37+
},
38+
{
39+
"resource": { "db": "admin", "collection": "system.version" },
40+
"actions": [ "find" ]
41+
},
42+
{
43+
"resource": { "db": "", "collection": "system.js" },
44+
"actions": [ "listCollections", "listIndexes" ]
45+
},
46+
{
47+
"resource": { "db": "config", "collection": "shards" },
48+
"actions": [ "find" ]
49+
},
50+
{
51+
"resource": { "db": "config", "collection": "collections" },
52+
"actions": [ "find" ]
53+
},
54+
{
55+
"resource": { "db": "config", "collection": "version" },
56+
"actions": [ "find" ]
57+
},
58+
{
59+
"resource": { "db": "config", "collection": "settings" },
60+
"actions": [ "find" ]
61+
},
62+
{
63+
"resource": { "system_buckets": "" },
64+
"actions": [ "listCollections", "listIndexes" ]
65+
}
66+
]
67+
68+
* - Write-blocking
69+
- Everything from the default source privileges with the addition of:
70+
71+
.. code-block:: javascript
72+
73+
[
74+
{
75+
"resource": { "cluster": true },
76+
"actions": [ "bypassWriteBlockingMode", "setUserWriteBlockMode" ]
77+
}
78+
]
79+
80+
* - Reversing
81+
- Everything from the default source privileges and the default destination
82+
privileges.
83+
84+
* - Multiple Reversals
85+
- Everything from the default source privileges and the default destination
86+
privileges with the addition of:
87+
88+
.. code-block:: javascript
89+
90+
[
91+
{ "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
92+
]
93+
94+
* - V4.4 Migration
95+
- .. code-block:: javascript
96+
97+
[
98+
{
99+
"resource": { "cluster": true },
100+
"actions": [
101+
"addShard",
102+
"appendOplogNote",
103+
"flushRouterConfig",
104+
"getDefaultRWConcern",
105+
"getShardMap",
106+
"hostInfo",
107+
"listDatabases",
108+
"listShards",
109+
"replSetGetConfig",
110+
"replSetGetStatus",
111+
"serverStatus"
112+
]
113+
},
114+
{
115+
"resource": { "db": "", "collection": "" },
116+
"actions": [
117+
"changeStream",
118+
"collStats",
119+
"find",
120+
"indexStats",
121+
"listCollections",
122+
"listIndexes"
123+
]
124+
},
125+
{
126+
"resource": { "db": "admin", "collection": "system.version" },
127+
"actions": [ "find" ]
128+
},
129+
{
130+
"resource": { "db": "", "collection": "system.js" },
131+
"actions": [ "listCollections", "listIndexes" ]
132+
},
133+
{
134+
"resource": { "db": "config", "collection": "shards" },
135+
"actions": [ "find" ]
136+
},
137+
{
138+
"resource": { "db": "config", "collection": "collections" },
139+
"actions": [ "find" ]
140+
},
141+
{
142+
"resource": { "db": "config", "collection": "version" },
143+
"actions": [ "find" ]
144+
},
145+
{
146+
"resource": { "db": "config", "collection": "settings" },
147+
"actions": [ "find" ]
148+
}
149+
]
150+
151+

‎source/reference/permissions.txt

Lines changed: 89 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,98 @@ The Atlas permissions are:
2828

2929
.. include:: /includes/table-permissions-atlas.rst
3030

31+
.. _c2c-minimum-privileges:
32+
33+
Minimum Privileges
34+
------------------
35+
36+
.. note::
37+
38+
Minimum privileges may change across mongosync versions.
39+
40+
The minimum source privileges are:
41+
42+
.. include:: /includes/minimum-source-privileges.rst
43+
44+
The minimum destination privileges are:
45+
46+
.. include:: /includes/minimum-destination-privileges.rst
47+
3148
.. _c2c-older-version-permissions:
3249

3350
Pre-6.0 Migrations
3451
------------------
3552

36-
- When migrating from a 4.4 source cluster, you must have
37-
:authrole:`clusterManager` permissions on the source cluster.
53+
- When migrating from a 4.4 source cluster, the source cluster
54+
should either have :authrole:`clusterManager` or the minimum
55+
permissions listed for v4.4.
56+
57+
The minimum source permissions for v4.4 are:
58+
59+
.. list-table::
60+
:header-rows: 1
61+
:stub-columns: 1
62+
:widths: 10 30
63+
64+
* - Sync Type
65+
- Minimum Source Privileges
66+
67+
* - V4.4 Migration
68+
- .. code-block:: javascript
69+
70+
[
71+
{
72+
"resource": { "cluster": true },
73+
"actions": [
74+
"addShard",
75+
"appendOplogNote",
76+
"flushRouterConfig",
77+
"getDefaultRWConcern",
78+
"getShardMap",
79+
"hostInfo",
80+
"listDatabases",
81+
"listShards",
82+
"replSetGetConfig",
83+
"replSetGetStatus",
84+
"serverStatus"
85+
]
86+
},
87+
{
88+
"resource": { "db": "", "collection": "" },
89+
"actions": [
90+
"changeStream",
91+
"collStats",
92+
"find",
93+
"indexStats",
94+
"listCollections",
95+
"listIndexes"
96+
]
97+
},
98+
{
99+
"resource": { "db": "admin", "collection": "system.version" },
100+
"actions": [ "find" ]
101+
},
102+
{
103+
"resource": { "db": "", "collection": "system.js" },
104+
"actions": [ "listCollections", "listIndexes" ]
105+
},
106+
{
107+
"resource": { "db": "config", "collection": "shards" },
108+
"actions": [ "find" ]
109+
},
110+
{
111+
"resource": { "db": "config", "collection": "collections" },
112+
"actions": [ "find" ]
113+
},
114+
{
115+
"resource": { "db": "config", "collection": "version" },
116+
"actions": [ "find" ]
117+
},
118+
{
119+
"resource": { "db": "config", "collection": "settings" },
120+
"actions": [ "find" ]
121+
}
122+
]
123+
124+
- Dual write-blocking and reverse sync are not supported.
38125

39-
- Write blocking and reverse sync are not supported.

0 commit comments

Comments
 (0)