Ensure that each role for each MongoDB database is needed and grants only the necessary privileges

SedangLevel 1Tinjauan manualmongodb

Deskripsi

Reviewing all roles periodically and eliminating unneeded roles as well as unneeded privileges from necessary roles helps minimize the privileges that each user has.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Perform the following command to view all roles on the database on which the command runs, including both built-in and user-defined roles, as well as the privileges granted by each role. Ensure that only necessary roles are listed and only the necessary privileges are listed for each role. db.runCommand( { rolesInfo: 1, showPrivileges: true, showBuiltinRoles: true } )

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To revoke specified privileges from the user-defined role on the database where the command is run. The revokePrivilegesFromRole command has the following syntax: { revokePrivilegesFromRole: "\<role\>", privileges: [ { resource: { \<resource\> }, actions: [ "\<action\>", ... ] }, ... ], }

Properti

Sistem operasi: Apa saja
Tag: mongodbprivileges
Referensi: CIS MongoDB 8 Benchmark v2.0.0 - 3.4 Ensure that each role for each MongoDB database is needed and grants only the necessary privileges