On this page本页内容
MongoDB grants access to data and commands through role-based authorization and provides built-in roles that provide the different levels of access commonly needed in a database system.MongoDB通过基于角色的授权授予对数据和命令的访问权，并提供内置角色，这些角色提供数据库系统中通常需要的不同级别的访问。You can additionally create user-defined roles.您还可以创建用户定义的角色。
A role grants privileges to perform sets of actions on defined resources.角色授予对定义的资源执行一组操作的权限。A given role applies to the database on which it is defined and can grant access down to a collection level of granularity.给定的角色应用于在其上定义该角色的数据库，并可以授予访问权限，直至达到粒度级别。
Each of MongoDB’s built-in roles defines access at the database level for all non-system collections in the role’s database and at the collection level for all system collections.MongoDB的每个内置角色在数据库级别为角色数据库中的所有非系统集合定义访问权限，在集合级别为所有系统集合定义访问权限。
MongoDB provides the built-in database user and database administration roles on every database.MongoDB为每个数据库提供内置的数据库用户和数据库管理角色。MongoDB provides all other built-in roles only on the MongoDB只在admin database.admin数据库上提供所有其他内置角色。
This section describes the privileges for each built-in role.本节介绍每个内置角色的权限。You can also view the privileges for a built-in role at any time by issuing the 您还可以随时查看内置角色的权限，方法是在rolesInfo command with the showPrivileges and showBuiltinRoles fields both set to true.showPrivileges和showBuiltinRoles字段都设置为true的情况下发出rolesInfo命令。
Every database includes the following client roles:每个数据库都包含以下客户端角色：
read¶Provides the ability to read data on all non-system collections and the 提供读取所有非系统集合和 system.js collection.system.js集合上的数据的能力。
Aside
Starting in MongoDB 4.2, the role no longer provides privileges to access the 从MongoDB 4.2开始，角色不再提供直接访问system.namespaces collection directly.system.namespaces集合的特权。Direct access to the collection has been deprecated since MongoDB 3.0.自MongoDB 3.0以来，对集合的直接访问已被弃用。
In earlier versions, the role provided the aforementioned privilege actions on the 在早期版本中，角色在system.namespaces collection, thereby allowing direct access.system.namespaces集合上提供了上述特权操作，从而允许直接访问。
The role provides read access by granting the following actions:角色通过授予以下操作来提供读访问权限：
listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has privileges (including databases for which the user has privileges on specific collections) if the command is run with authorizedDatabases option unspecified or set to true.listDatabases权限操作，则如果在未指定authorizedDatabases选项或将其设置为true的情况下运行该命令，则用户可以运行listDatabases命令以返回用户具有权限的数据库列表（包括用户对特定集合具有权限的数据库）。listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has the find action privilege if the command is run with authorizedDatabases option unspecified or set to true.listDatabases权限操作，则如果在未指定authorizedDatabases选项或将其设置为true的情况下运行该命令，则用户可以运行listDatabases命令以返回用户具有查找操作权限的数据库列表。listDatabases privilege action, users can run the listDatabases command to return a list of databases for which the user has the find action privilege.listDatabases权限操作，则用户可以运行listDatabases命令返回用户具有查找操作权限的数据库列表。Every database includes the following database administration roles:每个数据库都包含以下数据库管理角色：
dbAdmin¶Provides the ability to perform administrative tasks such as schema-related tasks, indexing, and gathering statistics.提供执行管理任务的能力，例如与架构相关的任务、索引和收集统计信息。This role does not grant privileges for user and role management.此角色不授予用户和角色管理权限。
Specifically, the role provides the following privileges:具体而言，角色提供以下特权：
system.profile |
| ||
|
dbOwner¶The database owner can perform any administrative action on the database.数据库所有者可以对数据库执行任何管理操作。
This role combines the privileges granted by the 此角色结合了readWrite, dbAdmin and userAdmin roles.readWrite、dbAdmin和userAdmin角色授予的权限。
userAdmin¶Provides the ability to create and modify roles and users on the current database.提供在当前数据库上创建和修改角色和用户的功能。Since the 由于userAdmin role allows users to grant any privilege to any user, including themselves, the role also indirectly provides superuser access to either the database or, if scoped to the admin database, the cluster.userAdmin角色允许用户向任何用户（包括他们自己）授予任何权限，因此该角色还间接地向超级用户提供对数据库或集群（如果作用域为admin数据库）的访问。
The userAdmin role explicitly provides the following actions:userAdmin角色显式提供以下操作：
changeCustomDatachangePasswordcreateRolecreateUserdropRoledropUsergrantRolerevokeRolesetAuthenticationRestrictionviewRoleviewUserWarning
It is important to understand the security implications of granting the 理解授予userAdmin role: a user with this role for a database can assign themselves any privilege on that database.userAdmin角色的安全含义是很重要的：对于数据库具有此角色的用户可以为自己分配对该数据库的任何权限。Granting the 授予userAdmin role on the admin database has further security implications as this indirectly provides superuser access to a cluster.admin数据库上的userAdmin角色会带来进一步的安全问题，因为这会间接提供超级用户对集群的访问。With 使用admin scope a user with the userAdmin role can grant cluster-wide roles or privileges including userAdminAnyDatabase.admin范围，具有userAdmin角色的用户可以授予集群范围的角色或权限，包括userAdminAnyDatabase。
The admin database includes the following roles for administering the whole system rather than just a single database.admin数据库包括以下角色，用于管理整个系统，而不仅仅是单个数据库。These roles include but are not limited to replica set and sharded cluster administrative functions.这些角色包括但不限于副本集和分片集群管理功能。
clusterAdmin¶Provides the greatest cluster-management access.提供最大的群集管理访问。This role combines the privileges granted by the 此角色结合了clusterManager, clusterMonitor, and hostManager roles.clusterManager、clusterMonitor和hostManager角色授予的权限。Additionally, the role provides the 此外，角色还提供dropDatabase action.dropDatabase操作。
clusterManager¶Changed in version 3.4.在版本3.4中更改。
Provides management and monitoring actions on the cluster.提供群集上的管理和监视操作。A user with this role can access the 具有此角色的用户可以访问config and local databases, which are used in sharding and replication, respectively.config数据库和local数据库，它们分别用于分片和复制。
| |||
|
On the 在config database, permits the following actions:config数据库上，允许执行以下操作：
config databaseconfig数据库中的所有非系统集合 |
|||
system.js |
|
On the 在local database, permits the following actions:local数据库上，允许执行以下操作：
local databaselocal数据库中的所有非系统集合 |
|||
system.replset |
clusterMonitor¶Changed in version 3.4.在版本3.4中更改。
Provides read-only access to monitoring tools, such as the MongoDB Cloud Manager and Ops Manager monitoring agent.提供对监控工具（如MongoDB Cloud Manager和Ops Manager监控代理）的只读访问。
Permits the following actions on the cluster as a whole:允许对整个群集执行以下操作：
|
|
Permits the following actions on all databases in the cluster:允许对群集中的所有数据库执行以下操作：
collStatsdbStatsgetShardVersionindexStatsuseUUID (New in version 3.6)Permits the 允许在所有find action on all system.profile collections in the cluster.system.profile集合上执行find操作。
On the 在config database, permits the following actions:config数据库上，允许执行以下操作：
config databaseconfig数据库中的所有非系统集合 |
|
system.js |
|
On the 在local database, permits the following actions:local数据库上，允许执行以下操作：
local databaselocal数据库中的所有集合 |
|
system.js |
|
system.replset, |
find |
hostManager¶Provides the ability to monitor and manage servers.提供监视和管理服务器的功能。
On the cluster as a whole, provides the following actions:在整个集群上，提供以下操作：
|
4.4 Change
Starting in version 4.4, 从版本4.4开始，hostManager no longer provides the cpuProfiler privilege action on the cluster.hostManager不再在集群上提供cpuProfiler特权操作。
On all databases in the cluster, provides the following actions:在群集中的所有数据库上，提供以下操作：
The admin database includes the following roles for backing up and restoring data:admin数据库包括以下用于备份和还原数据的角色：
backup备份Provides minimal privileges needed for backing up data.提供备份数据所需的最低权限。This role provides sufficient privileges to use the MongoDB Cloud Manager backup agent, Ops Manager backup agent, or to use 此角色提供足够的权限来使用MongoDB Cloud Manager备份代理、Ops Manager备份代理或使用mongodump to back up an entire mongod instance.mongodump备份整个mongod实例。
Provides the 在insert and update actions on the mms.backup collection in the admin database and on the settings collection in the config database.admin数据库中的mms.backup集合上和config数据库中的settings集合上提供insert和update操作。
On anyResource, provides the在任何资源上，提供
listDatabaseslistCollectionslistIndexesOn the cluster as a whole, provides the在整个集群上，提供
appendOplogNotegetParameterlistDatabasesserverStatus (Starting in MongoDB 4.2)Provides the 提供以下find action on the following:find操作：
config and local databasesconfig数据库和local数据库中的集合system.js, and和system.profile
admin.system.users and admin.system.roles collectionsadmin.system.users集合以及admin.system.roles集合config.settings collectionconfig.settings集合。system.users collections from versions of MongoDB prior to 2.6system.usersMongoDB 2.6之前版本的集合Provides the 在insert and update actions on the config.settings collection.config.settings集合上提供insert和update操作。
Changed in version 3.2.1:在版本3.2.1中更改：The backup role provides additional privileges to back up the system.profile collection that exists when running with database profiling.backup角色提供其他权限来备份system.profile集合，该集合在使用数据库明细运行时存在。Previously, users required 以前，用户要求对此集合具有read access on this collection.read权限。
restore¶Changed in version 3.6:在版本3.6中更改：Provides 在非系统集合上提供convertToCapped on non-system collections.convertToCapped。
Provides the necessary privileges to restore data from backups if the data does not include 提供从备份中还原数据（如果数据不包括system.profile collection data and you run mongorestore without the --oplogReplay option.system.profile集合数据）所需的权限，以及运行mongorestore而不使用--oplogReplay选项所需的权限。
If the backup data includes 如果备份数据包括system.profile collection data or you run with --oplogReplay, you need additional privileges:system.profile集合数据，或你使用--oplogReplay运行数据还原，你就需要另外的权限。
system.profile |
|
--oplogReplay |
|
Provides the following action on the cluster as a whole:对整个群集提供以下操作：
Provides the following actions on all non-system collections:对所有非系统集合提供以下操作：
bypassDocumentValidationchangeCustomDatachangePasswordcollModconvertToCappedcreateCollectioncreateIndexcreateRolecreateUserdropCollectiondropRoledropUsergrantRoleinsertrevokeRoleviewRoleviewUserProvides the following actions on 在system.js collection:system.js集合上提供以下操作：
Provides the following action on anyResource:在任意资源上提供以下操作：
Provides the following actions on all non-system collections on the 对config and the local databases:config数据库和local数据库上的所有非系统集合提供以下操作：
Provides the following actions on 在admin.system.versionadmin.system.version上提供以下操作：
Provides the following action on 在admin.system.rolesadmin.system.roles上提供以下操作：
Provides the following actions on 在admin.system.users and legacy system.users collections:admin.system.users和历史遗留的system.users集合上提供以下操作：
bypassDocumentValidationcollModcreateCollectioncreateIndexdropCollectionfindinsertremoveupdateAlthough, 不过，restore includes the ability to modify the documents in the admin.system.users collection using normal modification operations, only modify these data using the user management methods.restore包括使用常规的修改操作修改admin.system.users中的文档的能力，只使用用户管理方法修改这些数据。
Aside旁白
Starting in version 4.2, MongoDB removes the 从4.2版开始，MongoDB删除了system.namespaces collection.system.namespaces集合。As such, the 因此，restore role no longer provides privileges to access these collections.restore角色不再提供访问这些集合的权限。Direct access to these collections has been deprecated since MongoDB 3.0.自MongoDB 3.0以来，对这些集合的直接访问已被弃用。
In earlier versions, the 在早期版本中，restore role provides the aforementioned privilege actions on the system.namespaces collection, thereby allowing direct access to the collection.restore角色在system.namespaces集合上提供上述的特权操作，从而允许直接访问该集合。
Changed in version 3.4.在版本3.4中更改。
The following roles are available on the 以下角色在admin database and provide privileges which apply to all databases except local and config:admin数据库上可用，并提供适用于除local和config之外的所有数据库的权限：
readAnyDatabase¶Provides the same read-only privileges as 提供与在除read on all databases except local and config.local和config之外的所有数据库上read相同的只读权限。The role also provides the 该角色还提供对整个集群的listDatabases action on the cluster as a whole.listDatabases操作。
Changed in version 3.4:在版本3.4中更改：Prior to 3.4, 在3.4之前，readAnyDatabase includes local and config databases.readAnyDatabase包括local和config数据库。To provide 要在read privileges on the local database, create a user in the admin database with read role in the local database.local数据库上提供read权限，请在admin数据库中创建一个在local数据库中具有read角色的用户。
See also the 另请参阅clusterManager and clusterMonitor roles for access to the config and local databases.clusterManager和clusterMonitor角色以获取对配置和本地数据库的访问。
readWriteAnyDatabase¶Provides the same privileges as 在除readWrite on all databases except local and config.local和config之外的所有数据库上提供与readWrite相同的权限。The role also provides the 该角色还提供对整个集群的listDatabases action on the cluster as a whole.listDatabases操作。
Changed in version 3.4:在版本3.4中更改：Prior to 3.4, 在3.4之前，readWriteAnyDatabase includes local and config databases.readWriteAnyDatabase包括local和config数据库。To provide 要在readWrite privileges on the local database, create a user in the admin database with readWrite role in the local database.local数据库上提供readWrite权限，请在admin数据库中创建一个在local数据库中具有readWrite角色的用户。
See also the 另请参阅clusterManager and clusterMonitor roles for access to the config and local databases.clusterManager和clusterMonitor角色以获取对config和local数据库的访问。
userAdminAnyDatabase¶Provides the same access to user administration operations as 在除userAdmin on all databases except local and config.local和config之外的所有数据库上提供与userAdmin相同的对用户管理操作的访问。
userAdminAnyDatabase also provides the following privilege actions on the cluster:还提供群集上的以下特权操作：
The role also provides the following privilege actions on the 该角色还在system.users and system.roles collections on the admin database, and on legacy system.users collections from versions of MongoDB prior to 2.6:admin数据库的system.users和system.roles集合上，以及在历史遗留的system.users集合（来自的MongoDB 2.6版以前的版本）上提供以下权限：
Changed in version 2.6.4:在版本2.6.4中更改：userAdminAnyDatabase added the following privilege actions on the admin.system.users and admin.system.roles collections:userAdminAnyDatabase在admin.system.users集合以及admin.system.roles集合上添加了以下权限操作：
The userAdminAnyDatabase role does not restrict the privileges that a user can grant.userAdminAnyDatabase角色不限制用户可以授予的权限。As a result, 因此，userAdminAnyDatabase users can grant themselves privileges in excess of their current privileges and even can grant themselves all privileges, even though the role does not explicitly authorize privileges beyond user administration.userAdminAnyDatabase用户可以授予自己超出其当前权限的权限，甚至可以授予自己所有权限，即使该角色没有显式授权超出用户管理权限的权限。This role is effectively a MongoDB system superuser.这个角色实际上是MongoDB系统的超级用户。
Changed in version 3.4:在版本3.4中更改：userAdminAnyDatabase no longer applies to the local and config databases.userAdminAnyDatabase不再应用于local和config数据库。
See also the 另请参阅clusterManager and clusterMonitor roles for access to the config and local databases.clusterManager和 clusterMonitor角色以获取对config和local数据库的访问。
dbAdminAnyDatabase¶Provides the same privileges as 在除dbAdmin on all databases except local and config.local和config之外的所有数据库上提供与dbAdmin相同的权限。The role also provides the 该角色还提供对整个集群的listDatabases action on the cluster as a whole.listDatabases操作。
Changed in version 3.4:在版本3.4中更改：Prior to 3.4, 在3.4之前，dbAdminAnyDatabase includes local and config databases.dbAdminDatabase包括local和config数据库。To provide 要在dbAdmin privileges on the local database, create a user in the admin database with dbAdmin role in the local database.local数据库上提供dbAdmin权限，请在admin数据库中创建一个在local数据库中具有dbAdmin角色的用户。
See also the 另请参阅clusterManager and clusterMonitor roles for access to the config and local databases.clusterManager角色和clusterMonitor角色以获取对config和local数据库的访问。
Several roles provide either indirect or direct system-wide superuser access.有几个角色提供间接或直接的系统级超级用户访问。
The following roles provide the ability to assign any user any privilege on any database, which means that users with one of these roles can assign themselves any privilege on any database:以下角色可以为任何用户分配任何数据库上的任何权限，这意味着具有这些角色之一的用户可以为自己分配任何数据库上的任何权限：
dbOwner role, when scoped to the admin databasedbOwner角色，作用域为admin数据库时userAdmin role, when scoped to the admin databaseuserAdmin角色，作用域为admin数据库时userAdminAnyDatabaseThe following role provides full privileges on all resources:以下角色提供对所有资源的完全权限：
__system¶MongoDB assigns this role to user objects that represent cluster members, such as replica set members and MongoDB将此角色分配给表示集群成员的用户对象，例如副本集成员和mongos instances.mongos实例。The role entitles its holder to take any action against any object in the database.角色使其持有者有权对数据库中的任何对象执行任何操作。
Do not assign this role to user objects representing applications or human administrators, other than in exceptional circumstances.除非在特殊情况下，否则不要将此角色分配给表示应用程序或人员管理员的用户对象。
If you need access to all actions on all resources, for example to run 如果需要访问所有资源上的所有操作（例如运行applyOps commands, do not assign this role.applyOps命令），请不要分配此角色。Instead, create a user-defined role that grants 相反，创建一个用户定义的角色，授予对任何资源的anyAction on anyResource and ensure that only the users who need access to these operations have this access.anyAction，并确保只有需要访问这些操作的用户才具有此访问权限。