Atlas Access Control and RBAC
Parent: MongoDB Compliance and Regulatory · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-63131ca29156
↓ Facts as markdownall context files
Source-anchored research for Atlas Access Control and RBAC. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- Atlas database users are separate from Atlas application users. Management roles govern Atlas UI/API actions, while database roles determine access when clients connect to clusters. (high confidence) [source]
- Atlas recommends assigning the minimum required permissions and using fine-grained custom database roles when predefined privileges are too broad; those roles can scope actions to particular databases and collections. (high confidence) [source]
- An Atlas custom role that grants insert can permit collection creation even when CREATE_COLLECTION is absent. A Terraform report reproduced this behavior, and the MongoDB privilege reference lists create among commands authorized by insert. (high confidence) [source]
Problems, failure modes and limitations
- Atlas custom-role actions cover a subset of the actions available to built-in roles; a custom role cannot be assumed to reproduce every built-in capability. (low confidence) (verified as of 2026-10-14) [source]
Facts and statements
- Database role grants combine: Atlas applies custom roles together with built-in roles and directly assigned privileges, and a more restrictive role does not cancel a higher permission granted by another role. (high confidence) [source]
- Atlas database users can access all clusters and federated database instances in their project by default; administrators can restrict a user to selected instances. Resource scoping must therefore be reviewed separately from role selection. (high confidence) (verified as of 2026-10-23) [source]
- Atlas requires database users and roles to be managed through the Atlas UI, Atlas CLI, Atlas Administration API, or a supported integration; otherwise Atlas rolls back those modifications. (high confidence) [source]
- Atlas supports temporary database users that expire automatically, making time-bounded access possible without leaving permanent database credentials. (high confidence) [source]
- In Terraform issue 1522, assigning a custom role against an application database produced HTTP 400 UNSUPPORTED_ROLE. Setting roles.database_name to admin fixed the assignment; the custom role resource still defined the actual database and collection privileges. Maintainers documented this distinction in January 2024. (low confidence) [source]
- Atlan documents a metadata-crawling custom role using listDatabases, sqlGetSchema, dbStats, listCollections, and collStats. Its JDBC validation also requires find, which its recipe scopes to a nonexistent collection to avoid reading existing collection contents. This is connector-specific guidance, not a universal Atlas requirement. (low confidence) (verified as of 2026-10-23) [source]
- Atlas can combine a built-in role, multiple custom roles, and specific privileges for one database user; specific privileges can target individual databases and collections. (high confidence) [source]
- HashiCorp provides an Atlas-specific Vault database plugin that generates unique, ephemeral database-user credentials from configured roles. (high confidence) [source]
- The Vault Atlas database plugin accepts role assignments and a scopes array in creation statements. If scopes is omitted, the plugin defaults to all scopes, so credential automation must explicitly preserve intended deployment restrictions. (high confidence) [source]
Children
- No children recorded.