Ensure that each role for each MongoDB database is needed and grants only the necessary privileges

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Perform the following command to view all roles on the database on which the command runs, including both built-in and user-defined roles, as well as the privileges granted by each role. Ensure that only necessary roles are listed and only the necessary privileges are listed for each role. db.runCommand( { rolesInfo: 1, showPrivileges: true, showBuiltinRoles: true } )

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To revoke specified privileges from the user-defined role on the database where the command is run. The revokePrivilegesFromRole command has the following syntax: { revokePrivilegesFromRole: "\<role\>", privileges: [ { resource: { \<resource\> }, actions: [ "\<action\>", ... ] }, ... ], }