Chapter 6. Security 418 { resource: { cluster : true }, actions: [ "shutdown" ] } Use the cluster resource for actions that affect the state of the system rather than act on specific set of databases or collections. Examples of such actions are shutdown , replSetReconfig , and addShard . For example, the following document grants the action shutdown on the cluster . { cluster : true } To specify the cluster as the resource, use the following syntax: For user-defined roles, only roles scoped for the admin database can have this resource specification for their privi- leges. { db: "", collection: "" } Specify All Non-System Collections in All Databases If both the db and collection fields are empty strings ( "" ), the resource is all collections, excluding the system collections (page 291), in all the databases: For user-defined roles, only roles scoped for the admin database can have this resource specification for their privi- leges. { db: "", collection: "accounts" } Specify Collections Across Databases as Resource If only the db field is an empty string ( "" ), the resource is all collections with the specified name across all databases. For example, the following document specifies the resource of all the accounts collections across all the databases: System collections include but are not limited to the following: { db: "test", collection: "system.js" } Note: When you specify a database as the resource, system collections are excluded, unless you name them explicitly, as in the following: For a user-defined role scoped for a non- admin database, the resource specification for its privileges must specify the same database as the role. User-defined roles scoped for the admin database can specify other databases. { db: "test", collection: "" } Specify a Database as Resource If only the collection field is an empty string ( "" ), the resource is the specified database, excluding the system collections (page 291). For example, the following resource document specifies the resource of the test database, excluding the system collections: For a user-defined role scoped for a non- admin database, the resource specification for its privileges must specify the same database as the role. User-defined roles scoped for the admin database can specify other databases. MongoDB Documentation, Release 3.0.4 • <database>.system.profile (page 291) • <database>.system.js (page 291) • system.users Collection (page 416) in the admin database • system.roles Collection (page 413) in the admin database Cluster Resource