Docs

Document Database for MongoDB

Account and access authorization

Using MongoDB with IAM user

Volcano Engine supports creating IAM users through the root account or users with management permissions. You can grant different permissions to different IAM users, enabling users with different identities under the same account to have different levels of access permissions, facilitating fine-grained permission management. This topic describes how to use Document Database for MongoDB through IAM users.

Background information

IAM overview

Identity and Access Management (short for IAM) is a permission management system provided by Volcano Engine, used to control the access permissions of different identities to cloud resources. IAM provides a series of functions such as multi-identity management, fine-grained permission management, login access or API access with Single Sign-On (SSO), security authentication, temporary token service, and operation auditing, meeting the needs of user permission separation and unified resource management in diverse scenarios. For more details about IAM, refer to IAM overview.

IAM policy

A policy is a description of permissions. IAM users, user groups, or roles need to be granted permissions by associating with the policy. The operation scope, resource scope, and permission activation conditions can be defined in a policy. IAM supports two types of policies: System default policy and user custom policy. For more details, refer to About policies.

Scope of policy

IAM supports specifying the scope of policies for users. The following two scopes are currently supported:

Global permissions: The authorized policy takes effect on the resources within all projects (including newly added projects in the future) under the account.

Project permissions: The policy only takes effect on the resources within the specified project.

Predefined policies for common cloud service systems

tip

In addition to the common predefined policies of the system, IAM also supports more fine-grained permission management through custom policies. For more details on custom policies, refer to Manage custom policies.

MongoDB cloud service

Before using the MongoDB cloud service through IAM users, you need to authorize the IAM user with relevant permissions for the MongoDB cloud service. The table below lists the system preset policies involved in the MongoDB cloud service for your reference.

System predefined policies involved	Description
MongoDBFullAccess	All management permissions of Document Database for MongoDB. IAM users with this permission will have read and write permissions for Document Database for MongoDB within the scope of the policy's action, such as creating instances, deleting instances, and editing instances. tip Document Database for MongoDB supports association with other cloud services (such as VPC, EIP). Therefore, if IAM users need to use other cloud services, you must also add corresponding management or read-only policies for those services. For more details, refer to Other common cloud services.
MongoDBReadOnlyAccess	Read-only access permission of Document Database for MongoDB. After adding this permission, users can view the MongoDB instances within the scope of the policy's action.

Other common cloud services

Document Database for MongoDB supports association with other cloud services (such as VPC, EIP). The following lists the system preset policies for some common cloud services for your reference.

Cloud service name	System predefined policies involved	Description
Virtual Private Cloud	VPCFullAccess	All management permissions of VPC. After adding this permission, users will have read and write permissions for the private network within the scope of the policy's action, such as creating a private network, associating a private network or subnet with a MongoDB instance and so on. tip You can specify a project when you create a VPC, but you cannot specify a project when you create a subnet, which is by default under the same project as the VPC to which it belongs. The project changes of the VPC and the subnet are independent, that is, modifying the project to which the VPC belongs will not modify the project of the subnet under the current VPC at the same time. For more details, refer to Managing projects. If you change the project to which the VPC belongs, you also need to change the project of the subnets under the VPC to ensure the consistency of the projects to which they belong. Otherwise, when IAM user with non-global privileges creates a cloud resource (such as Document Database for MongoDB), it will not be able to select a subnet or anomalies will be reported. For specific procedures for modifying projects, refer to Editing project.
Virtual Private Cloud		VPCReadOnlyAccess	Read-only access permission of the VPC. After adding this permission, users can view the private network and subnet information of MongoDB instances within the scope of the policy's action.
Public IP	EIPFullAccess	All management permissions of the public IP (EIP). After adding this permission, users will have read and write access to public IPs within the policy's scope, such as applying for public IPs or associating public IPs with MongoDB instances and so on.
Public IP		EIPReadOnlyAccess	Read-only access permission for public IP (EIP). After adding this permission, users can view the public IP information of MongoDB instances within the scope of the policy's action.
Cloud monitor	CloudMonitorFullAccess	All management permissions for cloud monitoring (CloudMonitor). After adding this permission, users will have read and write permissions for the monitoring and alerting of MongoDB instances within the scope of the policy's action, such as viewing the monitoring data of instances, adding alerting strategies to instances and so on.
Cloud monitor		CloudMonitorReadOnlyAccess	Read-only access permission for cloud monitoring (CloudMonitor). After adding this permission, users can view monitoring data of MongoDB instances within the scope of the policy. tip If IAM user needs to view monitoring information, this permission must be added for the IAM user within the global scope.
Database Workshop	DbwFullAccess	All management permissions of the Database Workshop (DBW). After adding this permission, users will have read and write permissions for the DBW within the scope of the policy's action, such as using the DBW to log in to MongoDB instance and use the data interaction console function and so on. tip If an IAM user needs to use DBW to log in to or manage MongoDB instances, they need to add this permission for the IAM user within the global scope.
Billing center	BillingCenterFullAccess	All read and write permissions of the billing center, including the management permissions of all pages and related OpenAPI of the billing center. After adding this permission, users will have read and write permissions for the billing center within the scope of the policy's action, such as recharging, renewing, and canceling subscriptions for instances through the billing center. tip If IAM users need to perform operations such as recharging, renewing, or unsubscribing for MongoDB instance, add this permission for the IAM user within the global scope. If you convert a pay-as-you-go MongoDB instance's billing type to subscription, even if the IAM user has the BillingCenterFullAccess permission for the instance under the corresponding project, you still need to re-add the BillingCenterFullAccess permission for the IAM user within the global scope. Otherwise, the IAM user will receive a permission insufficiency error when unsubscribing or renewing the instance.
Tag resources	TagFullAccess	This policy allows you to manage tag service-related content within the account, for example, querying by tags and other related content. For more details about tags, refer to Tag management. tip If IAM users need to add tags to MongoDB instance, they can directly see the existing tags under the root account in the drop-down lists of tag keys and tag values. The root account needs to add this permission for the IAM user in the global scope. Otherwise, the drop-down list seen by the IAM user is empty. IAM users can add new tags to an instance even without TagFullAccess permission. For specific procedures on adding tags, refer to Associating or adding tag.

Precautions

Allowlists which created before October 17, 2024, are only effective globally and not within a specified project. Therefore, if the scope of the MongoDBFullAccess or MongoDBReadOnlyAccess policy granted to the IAM user is project permissions, to ensure the IAM user can access or manage MongoDB's existing allowlists, submit a ticket to contact technical support to add the allowlists that need to be accessed or managed to the IAM user's project. Otherwise, the IAM user will receive an insufficient permission error when using features related to the corresponding allowlist.

Procedure

Create IAM user.

tip

When creating IAM users, you can directly add system pre-defined policies for MongoDB and other associated services and specify the policy scope.

Add permissions to IAM user.

tip

To ensure the security of cloud resources and reduce the risk of root account AK/SK leakage, we recommend creating separate AK/SK for IAM users to call MongoDB-related API interfaces. For details on creating AK/SK, refer to Managing access key.

Last updated: 2026.02.02 20:49:18