MongoDB: Limit user to find documents only by ObjectId

mongodbmongodb-4.0permissions

I'm using mongoDB version 4.0.9 for various things. One of them is storing and retrieving files in mongoDB via GridFS. For that purpose, I have created a role/user in mongo with the privileges "createCollection", "find", "insert", and "createIndex".

However, I would like to limit the user's reading rights to only find documents by their ObjectId because this is all I need: The mentioned mongoDB user gets the ObjectIds from another data source and retrieves documents only by their id.

Right now, that user could list all documents via the find command. That means if an attacker was able to hijack that user's account, they could read everything.

If, however, there was a way to limit the user's rights to only read documents by their id then the attacker would be forced to brute force the ObjectId and that could easily be detected in the log files.

Best Answer

Currently, The lower level you can control the access of resources is at the collection level.

One option you can try is to create collections at each user level and give the user access to only that collection.