Docs

Document Database for MongoDB

FAQ

Account permissions

This topic summarizes account and permission FAQs for Document Database for MongoDB.

What account permissions does Document Database for MongoDB currently provide?

Document Database for MongoDB provides the following account permissions. For more details about account permissions, refer to Database and account permissions.

Permission type	Permission name	Permissions description
Administrator operation permission	dbAdmin	Permission to perform management operations on database objects, but not read/write operations on the database.
		userAdmin	Permission to create users on this database.
		dbOwner	Permission to perform all operations on this database.
Cluster operation permission	clusterMonitor	Permissions to query clusters and replica sets.
Ordinary operation permission	read	Permission to perform query operations on this database.
Ordinary operation permission		readWrite	Permission to perform add, delete, modify, query operations on this database.
Instance operation permission	readAnyDatabase	Permission to query all databases in this instance.
		readWriteAnyDatabase	Permissions to create, delete, modify, and query all databases in this instance.
		userAdminAnyDatabase	Permissions to create users on all databases in this instance.
		dbAdminAnyDatabase	dbAdmin permissions for all databases in this instance.
Backup operation permission	backup	Permission to perform backup operations on all databases in this instance.

Why is there already an account after instance created?

When you create a MongoDB instance, the system creates a root account with the built-in root permission of MongoDB in the admin database by default.

You can set the root account and password when Creating instance. You can also set the password for the root account after the instance is created. For specific procedures, refer to Resetting password.

How to create MongoDB database account?

Document Database for MongoDB automatically creates an account with root permissions in the admin database by default. You can also create accounts with other permissions to give users specific permission for specific databases. For specific procedures, refer to Creating account.

How to authorize cross-service access for IAM users?

Before using Document Database for MongoDB, you need to authorize cross-service access to allow Redis instances to access other services (such as VPC and EIP). For specific procedures, refer to Cross-service access authorization.

If you need to authorize cross-service access for IAM users, the IAM users must have the IAMFullAccess permissions, otherwise an error will occur during authorization. For more information on how to authorize IAM users, refer to About users.

How to change password of MongoDB database account?

You can choose any of the following methods to change database account password:

Modify via MongoDB console

For specific procedures on modifying account passwords via the MongoDB console, refer to Modifying password or Reset root account.

Modify via API

You can call the ResetDBAccount API to modify the password of a specified account in the target MongoDB instance.

Modify via db.changeUserPassword() command

You can use the db.changeUserPassword() command to modify the password of a specified account (including root accounts and self-created accounts). For specific usage, refer to db.changeUserPassword().

Why do connections fail when account passwords in the connection string include special characters?

Document Database for MongoDB supports using _#!@$%^&*()+=- special characters in database account passwords. However, when you connect to a MongoDB instance via MongoDB shell tools or program code, some special characters may cause program ambiguity and cannot be recognized correctly, leading to connection failure. You need to escape these characters into their corresponding URL encodings before using them in the connection string for correct recognition.

Special characters that need to be escaped in the connection string and their corresponding URL encodings are shown in the table below.

Special character	Escaped URL encoding
!	%21
#	%23
$	%24
%	%25
@	%40

Last updated: 2026.01.04 20:19:38