Docs Menu
Docs Home
/
MongoDB Cluster-to-Cluster Sync
/
Reference

User Permissions

On this page

  • Self-Managed Clusters
  • Atlas Clusters
  • Minimum Privileges
  • Pre-6.0 Migrations

The user specified in the mongosync connection string must have the required permissions on the source and destination clusters. The permissions vary depending on your environment and if you want to modify write-blocking settings or use reverse sync.

Self-Managed Clusters

The self-managed permissions are:

Sync Type
Required Source Permissions
Required Destination Permissions

Default

  • backup

  • clusterMonitor

  • readAnyDatabase

Dual Write-Blocking

Reversing

Multiple Reversals

For details on server roles, see: Role-Based Access Control in Self-Managed Deployments.

To update user permissions, see: grantRolesToUser.

Atlas Clusters

The Atlas permissions are:

Sync Type
Required Source Permissions
Required Destination Permissions

Default

  • atlasAdmin

Dual write-blocking, reversing, or multiple reversals

For details on Atlas roles, see: Built-In Roles and Privileges.

To update Atlas user permissions, see: Manage Access to a Project.

Minimum Privileges

Note

Minimum privileges may change across mongosync versions.

The minimum source privileges are:

Sync Type
Minimum Source Privileges

Default

[
   {
       "resource": { "cluster": true },
       "actions": [
          "appendOplogNote",
          "getDefaultRWConcern",
          "getShardMap",
          "hostInfo",
          "listDatabases",
          "listShards",
          "replSetGetConfig",
          "replSetGetStatus",
          "serverStatus"
       ]
   },
   {
       "resource": { "db": "", "collection": "" },
       "actions": [
          "changeStream",
          "collStats",
          "find",
          "indexStats",
          "listCollections",
          "listIndexes"
     ]
   },
   {
       "resource": { "db": "admin", "collection": "system.version" },
       "actions": [ "find" ]
   },
   {
       "resource": { "db": "", "collection": "system.js" },
       "actions": [ "listCollections", "listIndexes" ]
   },
   {
       "resource": { "db": "config", "collection": "shards" },
       "actions": [ "find" ]
   },
   {
       "resource": { "db": "config", "collection": "collections" },
       "actions": [ "find" ]
   },
   {
       "resource": { "db": "config", "collection": "version" },
       "actions": [ "find" ]
   },
   {
       "resource": { "db": "config", "collection": "settings" },
       "actions": [ "find" ]
   },
   {
       "resource": { "system_buckets": "" },
       "actions": [ "listCollections", "listIndexes" ]
   }
]

Write-blocking

Everything from the default source privileges with the addition of:

[
  {
      "resource": { "cluster": true },
      "actions": [ "bypassWriteBlockingMode", "setUserWriteBlockMode" ]
  }
]

Reversing

Everything from the default source privileges and the default destination privileges.

Multiple Reversals

Everything from the default source privileges and the default destination privileges with the addition of:

[
    { "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
]

V4.4 Migration

[
   {
      "resource": { "cluster": true },
      "actions": [
         "addShard",
         "appendOplogNote",
         "flushRouterConfig",
         "getDefaultRWConcern",
         "getShardMap",
         "hostInfo",
         "listDatabases",
         "listShards",
         "replSetGetConfig",
         "replSetGetStatus",
         "serverStatus"
     ]
   },
   {
      "resource": { "db": "", "collection": "" },
      "actions": [
         "changeStream",
         "collStats",
         "find",
         "indexStats",
         "listCollections",
         "listIndexes"
     ]
   },
   {
      "resource": { "db": "admin", "collection": "system.version" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "", "collection": "system.js" },
      "actions": [ "listCollections", "listIndexes" ]
   },
   {
      "resource": { "db": "config", "collection": "shards" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "config", "collection": "collections" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "config", "collection": "version" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "config", "collection": "settings" },
      "actions": [ "find" ]
   }
]

The minimum destination privileges are:

Sync Type
Minimum Destination Privileges

Default

[
   {
      "resource": { "cluster": true },
      "actions": [
         "appendOplogNote",
         "enableSharding",
         "getDefaultRWConcern",
         "getShardMap",
         "hostInfo",
         "listDatabases",
         "listShards",
         "replSetGetConfig",
         "replSetGetStatus",
         "serverStatus"
     ]
   },
   {
      "resource": { "db": "", "collection": "" },
      "actions": [
         "bypassDocumentValidation",
         "changeStream",
         "collMod",
         "convertToCapped",
         "createCollection",
         "createIndex",
         "dropCollection",
         "dropIndex",
         "enableSharding",
         "find",
         "indexStats",
         "insert",
         "listCollections",
         "listIndexes",
         "remove",
         "renameCollectionSameDB",
         "update",
         "bypassWriteBlockingMode",
         "setUserWriteBlockMode"
     ]
   },
   {
      "resource": { "db": "admin", "collection": "system.version" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "", "collection": "system.js" },
      "actions": [ "listCollections", "listIndexes" ]
   },
   {
      "resource": { "db": "config", "collection": "shards" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "", "collection": "system.views" },
      "actions": [ "dropCollection" ]
   },
   {
      "resource": { "db": "config", "collection": "version" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "config", "collection": "collections" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "config", "collection": "settings" },
      "actions": [ "find" ]
   },
   {
      "resource": { "db": "config", "collection": "tags" },
      "actions": [ "find" ]
   },
   {
      "resource": { "system_buckets": "" },
      "actions": [ "listCollections", "listIndexes" ]
   }
]

Write Blocking

Everything from the default destination privileges.

Reversing

Everything from the default source privileges and the default destination privileges with the addition of:

[
   { "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
]

Multiple Reversals

Everything from the default source privileges and the default destination privileges with the addition of:

[
   { "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
]

Pre-6.0 Migrations

  • When migrating from a 4.4 source cluster, the source cluster should either have clusterManager or the minimum permissions listed for v4.4.

    The minimum source permissions for v4.4 are:

    Sync Type
    Minimum Source Privileges

    V4.4 Migration

    [
       {
          "resource": { "cluster": true },
          "actions": [
             "addShard",
             "appendOplogNote",
             "flushRouterConfig",
             "getDefaultRWConcern",
             "getShardMap",
             "hostInfo",
             "listDatabases",
             "listShards",
             "replSetGetConfig",
             "replSetGetStatus",
             "serverStatus"
         ]
       },
       {
          "resource": { "db": "", "collection": "" },
          "actions": [
             "changeStream",
             "collStats",
             "find",
             "indexStats",
             "listCollections",
             "listIndexes"
         ]
       },
       {
          "resource": { "db": "admin", "collection": "system.version" },
          "actions": [ "find" ]
       },
       {
          "resource": { "db": "", "collection": "system.js" },
          "actions": [ "listCollections", "listIndexes" ]
       },
       {
          "resource": { "db": "config", "collection": "shards" },
          "actions": [ "find" ]
       },
       {
          "resource": { "db": "config", "collection": "collections" },
          "actions": [ "find" ]
       },
       {
          "resource": { "db": "config", "collection": "version" },
          "actions": [ "find" ]
       },
       {
          "resource": { "db": "config", "collection": "settings" },
          "actions": [ "find" ]
       }
    ]

  • Dual write-blocking and reverse sync are not supported.

Back

Logging

Next

Telemetry