MongoDB: db.updateRole() method

Last update on August 19 2022 21:50:43 (UTC/GMT +8 hours)

db.updateRole()

The db.updateRole() method is used to updates a user-defined role. An update to a field completely replaces the previous field’s values.

Syntax:

db.updateRole(
    "<rolename>",
    {
      privileges:
          [
            { resource: { <resource> }, actions: [ "<action>", ... ] },
            ...
          ],
      roles:
          [
            { role: "<role>", db: "<database>" } | "<role>",
            ...
          ]
    },
    { <writeConcern> }
)

The db.updateRole() method takes the following arguments.

Parameters:

Name	Description	Required / Optional	Type
rolename	The name of the user-defined role to update.	Required	string
update	A document containing the replacement data for the role. This data completely replaces the corresponding data for the role.	Required	document
writeConcern	The level of write concern for the update operation. The writeConcern document takes the same fields as the getLastError command.	Optional	document

The update document specifies the fields to update and the new values. Each field in the update document is optional, but the document must include at least one field. The update document has the following fields:

Name	Description	Required / Optional	Type
privileges	Required if you do not specify roles array. The privileges to grant the role. An update to the privileges array overrides the previous array’s values. For the syntax for specifying a privilege, see the privileges array.	Optional	array
roles	Required if you do not specify privileges array. The roles from which this role inherits privileges. An update to the roles array overrides the previous array’s values.	Optional	array

In the roles field, you can specify both built-in roles and user-defined role.

To specify a role that exists in the same database where db.updateRole() runs, you can either specify the role with the name of the role:

"readWrite"

Or you can specify the role with a document, as in:

{ role: "<role>", db: "<database>" }

To specify a role that exists in a different database, specify the role with a document.

Example: MongoDB: db.updateRole() method

The following db.updateRole() method replaces the privileges and the roles for the myroll1 role that exists in the admin database.

use admin
db.updateRole(
    "myroll1",
    {
      privileges:
          [
            {
              resource: { db:"config", collection:" " },
              actions: [ "update", "createCollection", "createIndex"]
            }
          ],
      roles:
          [
            {
              role: "read",
              db: "admin"
            }
          ]
    },
    { w:"majority" }
);

Now display the updated role on the "admin" database.

Output:

{
        "role" : "myroll1",
        "db" : "admin",
        "isBuiltin" : false,
        "roles" : [
                {
                        "role" : "read",
                        "db" : "admin"
                }
        ],
        "inheritedRoles" : [
                {
                        "role" : "read",
                        "db" : "admin"
                }
        ],
        "privileges" : [
                {
                        "resource" : {
                                "db" : "config",
                                "collection" : " "
                        },
                        "actions" : [
                                "createCollection",
                                "createIndex",
                                "update"
                        ]
                }
        ],
        "inheritedPrivileges" : [
                {
                        "resource" : {
                                "db" : "config",
                                "collection" : " "
                        },
                        "actions" : [
                                "createCollection",
                                "createIndex",
                                "update"
                        ]
                },
                {
                        "resource" : {
                                "db" : "admin",
                                "collection" : ""
                        },
                        "actions" : [
                                "collStats",
                                "dbHash",
                                "dbStats",
                                "find",
                                "killCursors",
                                "planCacheRead"
                        ]
                },
                {
                        "resource" : {
                                "db" : "admin",
                                "collection" : "system.indexes"
                        },
                        "actions" : [
                                "collStats",
                                "dbHash",
                                "dbStats",
                                "find",
                                "killCursors",
                                "planCacheRead"
                        ]
                },
                {
                        "resource" : {
                                "db" : "admin",
                                "collection" : "system.js"
                        },
                        "actions" : [
                                "collStats",
                                "dbHash",
                                "dbStats",
                                "find",
                                "killCursors",
                                "planCacheRead"
                        ]
                },
                {
                        "resource" : {
                                "db" : "admin",
                                "collection" : "system.namespaces"
                        },
                        "actions" : [
                                "collStats",
                                "dbHash",
                                "dbStats",
                                "find",
                                "killCursors",
                                "planCacheRead"
                        ]
                }
        ]
}

Retrieve the restaurants data from here

Behavior

Except for roles created in the admin database, a role can only include privileges that apply to its database and can only inherit from other roles in its database.

A role created in the admin database can include privileges that apply to the admin database, other databases or to the cluster resource, and can inherit from roles in other databases as well as the admin database.

Previous: db.createRole() method
Next: db.dropRole() method