I want my user to have only find action privilege on a specific collection. However, when I create the user with the privilege, restart the mongod server and run the mongo shell again with -u -p and --authenticationDatabase parameters and run insert command on the collection, it successfully inserts the document in collection. Similarly, update command also works seamlessly for this user and the corresponding collection.

Here's the code for creating the user-

use testauth
db.createUser({user: "user", pwd: "password", roles: [{role: "readWrite", db: "testauth", privileges: [{resource: {db: "testauth", collection: "readonlycol"}, actions: ["find"]}]}]})

Followed by this, I restart the mongod server with --auth and run the mongo shell with authentication parameters. When I go ahead and try to insert a document in the collection, it works -

> use testauth
> db.readonlycol.insert({"key": "value"})
WriteResult({ "nInserted" : 1 })

update also seems to work. The only command which doesn't work is remove. What am I doing wrong?

1 Answer 1


according to https://docs.mongodb.com/manual/reference/built-in-roles/

the "readwrite" is to blame ...


Provides all the privileges of the read role plus ability to modify data on all non-system collections and the system.js collection.

The role provides the following actions on those collections:

  • collStats
  • convertToCapped
  • createCollection
  • dbHash
  • dbStats
  • dropCollection
  • createIndex
  • dropIndex
  • find
  • insert
  • killCursors
  • listIndexes
  • listCollections
  • remove
  • renameCollectionSameDB
  • update

Although the list also contains the remove - right .

  • what I wanna achieve is to allow the user to only read and write to the database, with write permissions on a specific set of collections and read on another. How can I achieve this? what if I give read role to the user and give insert, delete and update as privileges to the specific collections? Oct 25, 2019 at 3:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.