Database Manual / Self-Managed Deployments / Security / Reference

Resource Document on Self-Managed Deployments关于自我管理部署的资源文档

The resource document specifies the resources upon which a privilege permits actions.资源文档指定了权限允许actions的资源。

Database and/or Collection Resource数据库和/或集合资源

To specify databases and/or collections, use the following syntax:要指定数据库和/或集合，请使用以下语法：

{ db: <database>, collection: <collection> }

Specify a Collection of a Database as Resource将数据库集合指定为资源

If the resource document specifies both the db and collection fields as non-empty strings, the resource is the specified collection in the specified database. For example, the following document specifies a resource of the inventory collection in the products database:如果资源文档将db和collection字段都指定为非空字符串，则资源是指定数据库中的指定集合。例如，以下文档指定了产品数据库中inventory集合的资源：

{ db: "products", collection: "inventory" }

For a user-defined role scoped for a non-admin database, the resource specification for its privileges must specify the same database as the role. User-defined roles scoped for the admin database can specify other databases.对于非admin数据库范围内的用户定义角色，其权限的资源规范必须指定与该角色相同的数据库。管理员数据库范围内的用户定义角色可以指定其他数据库。

Specify a Database as Resource将数据库指定为资源

If only the collection field is an empty string (""), the resource is the specified database, excluding the system collections. For example, the following resource document specifies the resource of the test database, excluding the system collections:如果只有collection字段是空字符串（""），则资源是指定的数据库，不包括系统集合。例如，以下资源文档指定了test数据库的资源，不包括系统集合：

{ db: "test", collection: "" }

For a user-defined role scoped for a non-admin database, the resource specification for its privileges must specify the same database as the role. User-defined roles scoped for the admin database can specify other databases.对于非admin数据库范围内的用户定义角色，其权限的资源规范必须指定与该角色相同的数据库。管理员数据库范围内的用户定义角色可以指定其他数据库。

Note

When you specify a database as the resource, system collections are excluded, unless you name them explicitly, as in the following:当您将数据库指定为资源时，系统集合将被排除在外，除非您明确地命名它们，如下所示：

{ db: "test", collection: "system.js" }

System collections include but are not limited to the following:系统集合包括但不限于以下内容：

Specify Collections Across Databases as Resource将跨数据库的集合指定为资源

If only the db field is an empty string (""), the resource is all collections with the specified name across all databases. For example, the following document specifies the resource of all the accounts collections across all the databases:如果只有db字段是空字符串（""），则资源是所有数据库中具有指定名称的所有集合。例如，以下文档指定了所有数据库中所有accounts集合的资源：

{ db: "", collection: "accounts" }

For user-defined roles, only roles scoped for the admin database can have this resource specification for their privileges.对于用户定义的角色，只有admin数据库范围内的角色才能拥有此资源规范作为其权限。

Specify All Non-System Collections in All Databases指定所有数据库中的所有非系统集合

If both the db and collection fields are empty strings (""), the resource is all collections, excluding the system collections, in all the databases:如果db和collection字段都是空字符串（""），则资源是所有数据库中的所有集合，不包括系统集合：

{ db: "", collection: "" }

For user-defined roles, only roles scoped for the admin database can have this resource specification for their privileges.对于用户定义的角色，只有管理员数据库范围内的角色才能拥有此资源规范作为其权限。

Cluster Resource集群资源

To specify the cluster as the resource, use the following syntax:要将群集指定为资源，请使用以下语法：

{ cluster : true }

Use the cluster resource for actions that affect the state of the system rather than act on specific set of databases or collections. 将cluster资源用于影响系统状态的操作，而不是对特定的数据库或集合进行操作。Examples of such actions are shutdown, replSetReconfig, and addShard. For example, the following document grants the action shutdown on the cluster.此类操作的示例包括shutdown、replSetReconfig和addShard。例如，以下文档允许在集群上执行关闭操作。

{ resource: { cluster : true }, actions: [ "shutdown" ] }

For user-defined roles, only roles scoped for the admin database can have this resource specification for their privileges.对于用户定义的角色，只有admin数据库范围内的角色才能拥有此资源规范作为其权限。

anyResource

The internal resource anyResource gives access to every resource in the system and is intended for internal use. Do not use this resource, other than in exceptional circumstances. The syntax for this resource is { anyResource: true }.内部资源anyResource允许访问系统中的所有资源，仅供内部使用。除非在特殊情况下，否则不要使用此资源。此资源的语法为{ anyResource: true }。