I'm using mongoDB version 4.0.9 for various things. One of them is storing and retrieving files in mongoDB via GridFS. For that purpose, I have created a role/user in mongo with the privileges "createCollection", "find", "insert", and "createIndex".
However, I would like to limit the user's reading rights to only find documents by their
ObjectId because this is all I need: The mentioned mongoDB user gets the
ObjectIds from another data source and retrieves documents only by their id.
Right now, that user could list all documents via the
find command. That means if an attacker was able to hijack that user's account, they could read everything.
If, however, there was a way to limit the user's rights to only read documents by their id then the attacker would be forced to brute force the
ObjectId and that could easily be detected in the log files.