mongoDB: Limit user to find documents only by ObjectId

Question

I'm using mongoDB version 4.0.9 for various things. One of them is storing and retrieving files in mongoDB via GridFS. For that purpose, I have created a role/user in mongo with the privileges "createCollection", "find", "insert", and "createIndex".

However, I would like to limit the user's reading rights to only find documents by their ObjectId because this is all I need: The mentioned mongoDB user gets the ObjectIds from another data source and retrieves documents only by their id.

Right now, that user could list all documents via the find command. That means if an attacker was able to hijack that user's account, they could read everything.

If, however, there was a way to limit the user's rights to only read documents by their id then the attacker would be forced to brute force the ObjectId and that could easily be detected in the log files.

• Stennie: If your users can't be trusted and need limited access to the data, this seems like a compelling reason to provide API access rather than direct access to your MongoDB deployment. It would be easier to monitor and rate limit your user requests via an API, and less risky to expose API endpoints instead of your MongoDB deployment. If end user requests are coming directly to your MongoDB server, you will also be detecting abuse logged after the fact instead of cutting off those requests before they waste server resources.

Answer 1

Currently, The lower level you can control the access of resources is at the collection level.

One option you can try is to create collections at each user level and give the user access to only that collection.