MongoDB Documentation, Release 3.0.4 For user-defined roles, only roles scoped for the admin database can have this resource specification for their privi- leges. The internal resource anyResource gives access to every resource in the system and is intended for internal use. Do not use this resource, other than in exceptional circumstances. The syntax for this resource is { anyResource: true } . New in version 2.6. Privilege actions define the operations a user can perform on a resource (page 417). A MongoDB privilege (page 325) comprises a resource (page 417) and the permitted actions. This page lists available actions grouped by common purpose. MongoDB provides built-in roles with pre-defined pairings of resources and permitted actions. For lists of the actions granted, see Built-In Roles (page 405). To define custom roles, see Create a Role (page 388). User can perform the db.collection.find() method. Apply this action to database or collection re- sources. User can perform the insert command. Apply this action to database or collection resources. anyResource Privilege Actions Query and Write Actions find insert remove update Database Management Actions changeCustomData changeOwnCustomData changeOwnPassword changePassword User can change the password of any user in the given database. Apply this action to database resources. Users can change their own passwords. Apply this action to database resources. See also Change Your Password and Custom Data (page 396). Users can change their own custom information. Apply this action to database resources. See also Change Your Password and Custom Data (page 396). User can change the custom information of any user in the given database. Apply this action to database resources. User can perform the update command. Apply this action to database or collection resources. User can perform the db.collection.remove() method. Apply this action to database or collection resources. 419 6.4. Security Reference