MongoDB User and Role Privilege Audit

Lists users with their roles and highlights root and high-privilege roles. A baseline check for security audits and least privilege.

#users#roles#authentication#hardening

mongodb · javascript

db.getSiblingDB("admin").system.users.find(
  {}, { user: 1, db: 1, roles: 1, "credentials.SCRAM-SHA-256": { $exists: true } }
).toArray().map(u => ({
  user: u.user, db: u.db,
  roles: u.roles.map(r => r.role + "@" + r.db).join(", "),
  privileged: u.roles.some(r => ["root","dbOwner","userAdminAnyDatabase","clusterAdmin"].includes(r.role))
}));

Operational Notes & Remediation Guidance

Ensure roles adhere to the principle of least privilege and review accounts with root or dbOwner access.

Production Safety & Execution Standards

This script is designed for read-only diagnostics; it does not alter schema or modify data directly.
Prior to executing on production systems under high load, verify the target database version (Min. Version: 4.0).
Exercise caution with mutating actions (e.g., terminating sessions or dropping indexes) referenced in the notes section.

Other MONGODB Diagnostic Scripts

View All (100)

#81Performance

Find Long-Running Operations in MongoDB (currentOp)

Lists active operations running longer than 5 seconds with plan summary and lock-wait info. Helps pick the operation to kill during a slowdown.

View Script

#82Storage

MongoDB Collection and Index Sizes

Ranks collections by document count, data, storage and index size. Used for capacity planning and spotting bloated indexes.

View Script

#83Performance

Find Unused Indexes in MongoDB ($indexStats)

Lists never-used indexes per collection. Offers cleanup candidates to cut write cost and memory use.

View Script

#84Replication

MongoDB Replica Set Lag and Oplog Window

Shows member state, lag behind the primary and the oplog window. Monitors replication health and resync risk.

View Script