Ensure that each role for each MongoDB database is needed and grants only the necessary privileges

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Perform the following command to view all roles on the database on which the command runs, including both built-in and user-defined roles, as well as the privileges granted by each role. Ensure that only necessary roles are listed and only the necessary privileges are listed for each role. db.runCommand( { rolesInfo: 1, showPrivileges: true, showBuiltinRoles: true } )

修正方法

修正方法: ガイダンスまたは IaC パッチ

To revoke specified privileges from the user-defined role on the database where the command is run. The revokePrivilegesFromRole command has the following syntax: { revokePrivilegesFromRole: "\<role\>", privileges: [ { resource: { \<resource\> }, actions: [ "\<action\>", ... ] }, ... ], }