resource-document.txt

.. _resource-document:

=================
Resource Document
=================

.. default-domain:: mongodb

.. contents:: On this page
   :local:
   :backlinks: none
   :depth: 1
   :class: singlecol

The resource document specifies the resources upon which a
privilege permits ``actions``.

Database and/or Collection Resource
-----------------------------------

To specify databases and/or collections, use the following syntax:

.. code-block:: javascript

   { db: <database>, collection: <collection> }

.. _resource-specific-db-collection:

Specify a Collection of a Database as Resource
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If the resource document species both the ``db`` and ``collection``
fields as non-empty strings, the resource is the specified
collection in the specified database. For example, the following
document specifies a resource of the ``inventory`` collection in the
``products`` database:

.. code-block:: javascript

   { db: "products", collection: "inventory" }

.. include:: /includes/resource-document-facts.rst
   :end-before: admin-resources

.. _resource-specific-db:

Specify a Database as Resource
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If only the ``collection`` field is an empty string (``""``), the
resource is the specified database, excluding the :doc:`system
collections </reference/system-collections>`. For example, the
following resource document specifies the resource of the ``test``
database, excluding the system collections:

.. code-block:: javascript

   { db: "test", collection: "" }

.. include:: /includes/resource-document-facts.rst
   :end-before: admin-resources

.. note:: When you specify a database as the resource, the system
   collections are excluded, unless you name them explicitly, as in the
   following:

   .. code-block:: javascript

      { db: "test", collection: "system.namespaces" }

   System collections include but are not limited to the following:

   - :data:`<database>.system.profile`
   - :data:`<database>.system.namespaces`
   - :data:`<database>.system.indexes`
   - :data:`<database>.system.js`
   - :data:`local.system.replset`
   - :doc:`/reference/system-users-collection` in the ``admin`` database
   - :doc:`/reference/system-roles-collection` in the ``admin`` database

.. _resource-specific-collection:

Specify Collections Across Databases as Resource
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If only the ``db`` field is an empty string (``""``), the resource is
all collections with the specified name across all databases. For
example, the following document specifies the resource of all
the ``accounts`` collections across all the databases:

.. code-block:: javascript

   { db: "", collection: "accounts" }

.. include:: /includes/resource-document-facts.rst
   :start-after: admin-resources

.. _resource-all-but-system-collections:

Specify All Non-System Collections in All Databases
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If both the ``db`` and ``collection`` fields are empty strings
(``""``), the resource is all collections, excluding the :doc:`system
collections </reference/system-collections>`, in all the databases:

.. code-block:: javascript

   { db: "", collection: "" }

.. include:: /includes/resource-document-facts.rst
   :start-after: admin-resources

.. _resource-cluster:

Cluster Resource
----------------

To specify the cluster as the resource, use the following syntax:

.. code-block:: javascript

   { cluster : true }

Use the ``cluster`` resource for actions that affect the state of the
system rather than act on specific set of databases or collections.
Examples of such actions are ``shutdown``, ``replSetReconfig``, and
``addShard``. For example, the following document grants the action
``shutdown`` on the ``cluster``.

.. code-block:: javascript

   { resource: { cluster : true }, actions: [ "shutdown" ] }

.. include:: /includes/resource-document-facts.rst
   :start-after: admin-resources

.. _resource-anyresource:

.. _anyResource:

``anyResource``
---------------

The internal resource ``anyResource`` gives access to every resource in
the system and is intended for internal use. **Do not** use this resource,
other than in exceptional circumstances. The syntax for this resource is
``{ anyResource: true }``.