MongoDB Developer
MongoDB
plus
Sign in to follow topics
MongoDB Developer Centerchevron-right
Developer Topicschevron-right
Productschevron-right
MongoDBchevron-right

How to Secure MongoDB Data Access with Views

Maxime BeugnetPublished Apr 07, 2023 • Updated Apr 07, 2023
MongoDBSecurity
Facebook Icontwitter iconlinkedin icon
Rate this article
star-empty
star-empty
star-empty
star-empty
star-empty

Introduction

Sometimes, MongoDB collections contain sensitive information that require access control. Using the Role-Based Access Control (RBAC) provided by MongoDB, it's easy to restrict access to this collection. But what if you want to share your collection to a wider audience without exposing sensitive data?
For example, it could be interesting to share your collections with the marketing team for analytics purposes without sharing personal identifiable information (PII) or data you prefer to keep private, like employee salaries.
It's possible to achieve this result with MongoDB views combined with the MongoDB RBAC, and this is what we are going to explore in this blog post.

Prerequisites

You'll need either:
  • A MongoDB cluster with authentication activated (which is somewhat recommended in production!).
  • A MongoDB Atlas cluster.
I'll assume you already have an admin user on your cluster with full authorizations or at least a user that can create views, custom roles. and users. If you are in Atlas, you can create this user in the Database Access tab or use the MongoDB Shell, like this:
Then you can connect with the command line provided in Atlas or like this, if you are not in Atlas:

Creating a MongoDB collection with sensitive data

In this example, I'll pretend to have an employees collection with sensitive data:

How to create a view in MongoDB to hide sensitive fields

Now I want to share this collection to a wider audience, but I don’t want to share the social security numbers and salaries.
To solve this issue, I can create a view with a $project stage that only allows a set of selected fields.
Note that I'm not doing {$project: {ssn: 0, salary: 0}} because every field except these two would appear in the view. It works today, but maybe tomorrow, I'll add a credit_card field in some documents. It would then appear instantly in the view.
Let's confirm that the view works:
Results:
Depending on your schema design and how you want to filter the fields, it could be easier to use $unset instead of $project. You can learn more in the Practical MongoDB Aggregations Book. But again, $unset will just remove the specified fields without filtering new fields that could be added in the future.

Managing data access with MongoDB roles and users

Now that we have our view, we can share this with restricted access rights. In MongoDB, we need to create a custom role to achieve this.
Here are the command lines if you are not in Atlas.
Then we can create the user:
If you are in Atlas, database access is managed directly in the Atlas website in the Database Access tab. You can also use the Atlas CLI if you feel like it.
Database access tab in Atlas
Then you need to create a custom role.
Custom Roles tab in Atlas
Create the custom role in Atlas
Note: In Step 2, I only selected the Collection Actions > Query and Write Actions > find option.
Now that your role is created, head back to the Database Users tab and create a user with this custom role.
Navigation to create a user in Atlas
Create a user in Atlas with a custom role

Testing data access control with restricted user account

Now that our user is created, we can confirm that this new restricted user doesn't have access to the underlying collection but has access to the view.

Wrap-up

In this blog post, you learned how to share your MongoDB collections to a wider audience — even the most critical ones — without exposing sensitive data.
Note that views can use the indexes from the source collection so your restricted user can leverage those for more advanced queries.
You could also choose to add an extra $match stage before your $project stage to filter entire documents from ever appearing in the view. You can see an example in the Practical MongoDB Aggregations Book. And don't forget to support the $match with an index!
Questions? Comments? Let's continue the conversation over at the MongoDB Developer Community.

Facebook Icontwitter iconlinkedin icon
Rate this article
star-empty
star-empty
star-empty
star-empty
star-empty
Related
Tutorial

Analyze Time-Series Data with Python and MongoDB Using PyMongoArrow and Pandas


Sep 21, 2023
Article

MongoDB.Live 2020 Keynote In Less Than 10 Minutes


Mar 21, 2023
Tutorial

Create a Data Pipeline for MongoDB Change Stream Using Pub/Sub BigQuery Subscription


Jul 11, 2023
Article

An Update on MongoDB's Ongoing Commitment to Swift


May 12, 2022
Table of Contents