MongoDB Documentation, Release 3.0.4 desired set of privileges, you can create a new, customized role in a particular database. Except for roles created in the admin database, a role can only include privileges that apply to its database and can only inherit from other roles in its database. A role created in the admin database can include privileges that apply to the admin database, other databases or to the cluster (page 418) resource, and can inherit from roles in other databases as well as the admin database. MongoDB uses the combination of the database name and the role name to uniquely define a role. To create a role in a database, the user must have: Built-in roles userAdmin (page 407) and userAdminAnyDatabase (page 412) provide createRole (page 420) and grantRole (page 420) actions on their respective resources (page 417). To create a new role, use the db.createRole() method, specifying the privileges in the privileges array and the inherited roles in the roles array. Create a Role to Manage Current Operations The following example creates a role named manageOpRole which provides only the privileges to run both db.currentOp() and db.killOp() . 71 Step 1: Connect to MongoDB with the appropriate privileges. Connect to mongod or mongos with the privi- leges specified in the Prerequisites (page 389) section. The following procedure uses the siteUserAdmin created in Create a User Administrator (page 384). mongo --port 27017 -u siteUserAdmin -p password --authenticationDatabase admin The siteUserAdmin has privileges to create roles in the admin as well as other databases. Step 2: Create a new role to manage current operations. manageOpRole has privileges that act on multiple databases as well as the cluster resource (page 418). As such, you must create the role in the admin database. use admin db.createRole( { role: "manageOpRole", privileges: [ { resource: { cluster: true }, actions: [ "killop", "inprog" ] }, { resource: { db: "", collection: "" }, actions: [ "killCursors" ] } ], roles: [] } ) 71 The built-in role clusterMonitor (page 409) also provides the privilege to run db.currentOp() along with other privileges, and the built-in role hostManager (page 410) provides the privilege to run db.killOp() along with other privileges. 6.3. Security Tutorials 389 Prerequisites Procedures • the createRole (page 420) action (page 419) on that database resource (page 418). • the grantRole (page 420) action (page 419) on that database to specify privileges for the new role as well as to specify roles to inherit from.