MongoDB® Index Builds – Preventing Users From Triggering New Builds

2 min read
MongoDB® Index Builds – Preventing Users From Triggering New Builds

SHARE THIS ARTICLE

Index builds on MongoDB production clusters need to be handled with the utmost care. We have documented the issues in detail in one of  our previous blog posts – The Perils of Building Indexes on MongoDB.

Depending on the size of your data, both foreground and background builds can bring your cluster down. So, how do you prevent your users from accidentally triggering index builds from the MongoDB CLI? The short answer is that you cannot. However, what you can do is remove the “CreateIndex” privilege from most of your users so that they cannot accidentally trigger an index build from the CLI. There should be very few users in your system who have access to write data to the database. Among these users, even fewer should have permission to build indexes. For a primer on how to use MongoDB roles, please refer to the documentation – Manage Users and Roles.

The best option to implement this is to create your own custom role and remove the ‘CreateIndex’ privilege for your users. However, we did not want to build the list of permissions by hand since this will be different for each context and possibly MongoDB version. We put together this small script to use one of the existing built-in roles, and removed the ‘CreateIndex’ privilege from this role. In this example, we are using the builtin “readWrite” role and removing the “CreateIndex’ privilege from this role:

var privs = db.getRole('readWrite',{ showPrivileges: true });
privs.privileges.forEach(function (item, index) {
  var index = item.actions.indexOf("createIndex");
  if (index !== -1) item.actions.splice(index, 1);
});
db.createRole({role:"readWriteNoIndex",privileges:privs.privileges,roles:[]});
  1. Save the contents of the code snippet as createRole.js.
  2. Run the script using the syntax below:
mongo -u <user> -p <password> <host>:27017/<db name> --authenticationDatabase admin createRole.js

Once the role is created, you can use this role to create users going forward.

More tips for you

How to Create Case-Insensitive Indexes in MongoDB

Case-insensitive indexes support queries that perform string comparisons without regard to the letter case. Collation gives you the ability to specify language-specific rules for string comparison. Learn more


How to Stop a Runaway Index Build in MongoDB

Index builds in MongoDB can have an adverse impact on the availability of your cluster. If you trigger a foreground index build on a large collection, your cluster may be unresponsive until the index build is complete. Learn more


MongoDB Regex, Index & Performance

MongoDB supports regular expressions using the $regex operator. However these MongoDB regex queries have a downside, all but one type of regex makes poor use of indexes and results in performance problems. Learn more

For more information, please visit www.scalegrid.io. Connect with ScaleGrid on LinkedIn, X, Facebook, and YouTube.
Table of Contents

Stay Ahead with ScaleGrid Insights

Dive into the world of database management with our monthly newsletter. Get expert tips, in-depth articles, and the latest news, directly to your inbox.

Related Posts

pitr mysql

Master MySQL Point in Time Recovery

Data loss or corruption can be daunting. With MySQL point-in-time recovery, you can restore your database to the moment before...

Setting Up MongoDB SSL Encryption

In a world where data security is essential, enabling MongoDB SSL is critical in fortifying your database. This guide walks...

distributed storage system

What is a Distributed Storage System

A distributed storage system is foundational in today’s data-driven landscape, ensuring data spread over multiple servers is reliable, accessible, and...

NEWS

Add Headline Here