Skip to content

Commit b907945

Browse files
gmiller-mdbgmiller-mdb
authored
DOCSP-47109-document-minimum-privileges (#650)
* DOCSP-47109-DOCSP-document-minimum-privileges * table stuff * table format * fix build error * spacing * actual spacing * changed spacing to 3 * re doing all of the spaces god * feedback
1 parent 2b21c07 commit b907945

File tree

3 files changed

+351
-2
lines changed

3 files changed

+351
-2
lines changed

‎source/includes/minimum-destination-privileges.rst

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
.. list-table::
2+
:header-rows: 1
3+
:stub-columns: 1
4+
:widths: 10 20
5+
6+
* - Sync Type
7+
- Minimum Destination Privileges
8+
9+
* - Default
10+
- .. code-block:: javascript
11+
12+
[
13+
{
14+
"resource": { "cluster": true },
15+
"actions": [
16+
"appendOplogNote",
17+
"enableSharding",
18+
"getDefaultRWConcern",
19+
"getShardMap",
20+
"hostInfo",
21+
"listDatabases",
22+
"listShards",
23+
"replSetGetConfig",
24+
"replSetGetStatus",
25+
"serverStatus"
26+
]
27+
},
28+
{
29+
"resource": { "db": "", "collection": "" },
30+
"actions": [
31+
"bypassDocumentValidation",
32+
"changeStream",
33+
"collMod",
34+
"convertToCapped",
35+
"createCollection",
36+
"createIndex",
37+
"dropCollection",
38+
"dropIndex",
39+
"enableSharding",
40+
"find",
41+
"indexStats",
42+
"insert",
43+
"listCollections",
44+
"listIndexes",
45+
"remove",
46+
"renameCollectionSameDB",
47+
"update",
48+
"bypassWriteBlockingMode",
49+
"setUserWriteBlockMode"
50+
]
51+
},
52+
{
53+
"resource": { "db": "admin", "collection": "system.version" },
54+
"actions": [ "find" ]
55+
},
56+
{
57+
"resource": { "db": "", "collection": "system.js" },
58+
"actions": [ "listCollections", "listIndexes" ]
59+
},
60+
{
61+
"resource": { "db": "config", "collection": "shards" },
62+
"actions": [ "find" ]
63+
},
64+
{
65+
"resource": { "db": "", "collection": "system.views" },
66+
"actions": [ "dropCollection" ]
67+
},
68+
{
69+
"resource": { "db": "config", "collection": "version" },
70+
"actions": [ "find" ]
71+
},
72+
{
73+
"resource": { "db": "config", "collection": "collections" },
74+
"actions": [ "find" ]
75+
},
76+
{
77+
"resource": { "db": "config", "collection": "settings" },
78+
"actions": [ "find" ]
79+
},
80+
{
81+
"resource": { "db": "config", "collection": "tags" },
82+
"actions": [ "find" ]
83+
},
84+
{
85+
"resource": { "system_buckets": "" },
86+
"actions": [ "listCollections", "listIndexes" ]
87+
}
88+
]
89+
90+
* - Write Blocking
91+
- Everything from the default destination privileges.
92+
93+
* - Reversing
94+
- Everything from the default source privileges and the default destination
95+
privileges with the addition of:
96+
97+
.. code-block:: javascript
98+
99+
[
100+
{ "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
101+
]
102+
103+
* - Multiple Reversals
104+
- Everything from the default source privileges and the default destination
105+
privileges with the addition of:
106+
107+
.. code-block:: javascript
108+
109+
[
110+
{ "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
111+
]
112+

‎source/includes/minimum-source-privileges.rst

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
.. list-table::
2+
:header-rows: 1
3+
:stub-columns: 1
4+
:widths: 10 30
5+
6+
* - Sync Type
7+
- Minimum Source Privileges
8+
9+
* - Default
10+
- .. code-block:: javascript
11+
12+
[
13+
{
14+
"resource": { "cluster": true },
15+
"actions": [
16+
"appendOplogNote",
17+
"getDefaultRWConcern",
18+
"getShardMap",
19+
"hostInfo",
20+
"listDatabases",
21+
"listShards",
22+
"replSetGetConfig",
23+
"replSetGetStatus",
24+
"serverStatus"
25+
]
26+
},
27+
{
28+
"resource": { "db": "", "collection": "" },
29+
"actions": [
30+
"changeStream",
31+
"collStats",
32+
"find",
33+
"indexStats",
34+
"listCollections",
35+
"listIndexes"
36+
]
37+
},
38+
{
39+
"resource": { "db": "admin", "collection": "system.version" },
40+
"actions": [ "find" ]
41+
},
42+
{
43+
"resource": { "db": "", "collection": "system.js" },
44+
"actions": [ "listCollections", "listIndexes" ]
45+
},
46+
{
47+
"resource": { "db": "config", "collection": "shards" },
48+
"actions": [ "find" ]
49+
},
50+
{
51+
"resource": { "db": "config", "collection": "collections" },
52+
"actions": [ "find" ]
53+
},
54+
{
55+
"resource": { "db": "config", "collection": "version" },
56+
"actions": [ "find" ]
57+
},
58+
{
59+
"resource": { "db": "config", "collection": "settings" },
60+
"actions": [ "find" ]
61+
},
62+
{
63+
"resource": { "system_buckets": "" },
64+
"actions": [ "listCollections", "listIndexes" ]
65+
}
66+
]
67+
68+
* - Write-blocking
69+
- Everything from the default source privileges with the addition of:
70+
71+
.. code-block:: javascript
72+
73+
[
74+
{
75+
"resource": { "cluster": true },
76+
"actions": [ "bypassWriteBlockingMode", "setUserWriteBlockMode" ]
77+
}
78+
]
79+
80+
* - Reversing
81+
- Everything from the default source privileges and the default destination
82+
privileges.
83+
84+
* - Multiple Reversals
85+
- Everything from the default source privileges and the default destination
86+
privileges with the addition of:
87+
88+
.. code-block:: javascript
89+
90+
[
91+
{ "resource": { "db": "", "collection": "" }, "actions": [ "dropDatabase" ] }
92+
]
93+
94+
* - V4.4 Migration
95+
- .. code-block:: javascript
96+
97+
[
98+
{
99+
"resource": { "cluster": true },
100+
"actions": [
101+
"addShard",
102+
"appendOplogNote",
103+
"flushRouterConfig",
104+
"getDefaultRWConcern",
105+
"getShardMap",
106+
"hostInfo",
107+
"listDatabases",
108+
"listShards",
109+
"replSetGetConfig",
110+
"replSetGetStatus",
111+
"serverStatus"
112+
]
113+
},
114+
{
115+
"resource": { "db": "", "collection": "" },
116+
"actions": [
117+
"changeStream",
118+
"collStats",
119+
"find",
120+
"indexStats",
121+
"listCollections",
122+
"listIndexes"
123+
]
124+
},
125+
{
126+
"resource": { "db": "admin", "collection": "system.version" },
127+
"actions": [ "find" ]
128+
},
129+
{
130+
"resource": { "db": "", "collection": "system.js" },
131+
"actions": [ "listCollections", "listIndexes" ]
132+
},
133+
{
134+
"resource": { "db": "config", "collection": "shards" },
135+
"actions": [ "find" ]
136+
},
137+
{
138+
"resource": { "db": "config", "collection": "collections" },
139+
"actions": [ "find" ]
140+
},
141+
{
142+
"resource": { "db": "config", "collection": "version" },
143+
"actions": [ "find" ]
144+
},
145+
{
146+
"resource": { "db": "config", "collection": "settings" },
147+
"actions": [ "find" ]
148+
}
149+
]
150+
151+

‎source/reference/permissions.txt

Lines changed: 88 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,98 @@ The Atlas permissions are:
3030

3131
.. include:: /includes/table-permissions-atlas.rst
3232

33+
.. _c2c-minimum-privileges:
34+
35+
Minimum Privileges
36+
------------------
37+
38+
.. note::
39+
40+
Minimum privileges may change across mongosync versions.
41+
42+
The minimum source privileges are:
43+
44+
.. include:: /includes/minimum-source-privileges.rst
45+
46+
The minimum destination privileges are:
47+
48+
.. include:: /includes/minimum-destination-privileges.rst
49+
3350
.. _c2c-older-version-permissions:
3451

3552
Pre-6.0 Migrations
3653
------------------
3754

38-
- When migrating from a 4.4 source cluster, you must have
39-
:authrole:`clusterManager` permissions on the source cluster.
55+
- When migrating from a 4.4 source cluster, the source cluster
56+
should either have :authrole:`clusterManager` or the minimum
57+
permissions listed for v4.4.
58+
59+
The minimum source permissions for v4.4 are:
60+
61+
.. list-table::
62+
:header-rows: 1
63+
:stub-columns: 1
64+
:widths: 10 30
65+
66+
* - Sync Type
67+
- Minimum Source Privileges
68+
69+
* - V4.4 Migration
70+
- .. code-block:: javascript
71+
72+
[
73+
{
74+
"resource": { "cluster": true },
75+
"actions": [
76+
"addShard",
77+
"appendOplogNote",
78+
"flushRouterConfig",
79+
"getDefaultRWConcern",
80+
"getShardMap",
81+
"hostInfo",
82+
"listDatabases",
83+
"listShards",
84+
"replSetGetConfig",
85+
"replSetGetStatus",
86+
"serverStatus"
87+
]
88+
},
89+
{
90+
"resource": { "db": "", "collection": "" },
91+
"actions": [
92+
"changeStream",
93+
"collStats",
94+
"find",
95+
"indexStats",
96+
"listCollections",
97+
"listIndexes"
98+
]
99+
},
100+
{
101+
"resource": { "db": "admin", "collection": "system.version" },
102+
"actions": [ "find" ]
103+
},
104+
{
105+
"resource": { "db": "", "collection": "system.js" },
106+
"actions": [ "listCollections", "listIndexes" ]
107+
},
108+
{
109+
"resource": { "db": "config", "collection": "shards" },
110+
"actions": [ "find" ]
111+
},
112+
{
113+
"resource": { "db": "config", "collection": "collections" },
114+
"actions": [ "find" ]
115+
},
116+
{
117+
"resource": { "db": "config", "collection": "version" },
118+
"actions": [ "find" ]
119+
},
120+
{
121+
"resource": { "db": "config", "collection": "settings" },
122+
"actions": [ "find" ]
123+
}
124+
]
40125

41126
- Dual write-blocking and reverse sync are not supported.
127+

0 commit comments

Comments
 (0)