MongoDB Atlas: database users and least-privilege roles
Shows how to fix mongoDB Atlas: database users and least-privilege roles. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
TL;DR
Use them before inventing workarounds. - SCRAM is the auth mechanism. When a key leaks or a service is retired, you revoke one user instead of rotating a shared credential. - Start with the narrowest role that works.
Steps
- - One user per service, named after the service. When a key leaks or a service is retired, you revoke one user instead of rotating a shared credential.
- Start with the narrowest role that works. A
not authorizederror tells you exactly which privilege is missing; widen deliberately, not by jumping to atlasAdmin. - Custom roles exist for fine-grained needs (a user that can read one collection and write another). Use them before inventing workarounds.
- SCRAM is the auth mechanism. Special characters in passwords must be URL-encoded in the connection string.
- After creating the user, connect with its credentials and run one representative write and one admin command you expect to fail. The failure confirms the boundary is real.
When to use
You are seeing this: Database users are separate from your Atlas login. Use this skill when you run into "MongoDB Atlas: database users and least-privilege roles".
When not to use
If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.
Versions
No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.
Why this happens
The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.