/ /

Stream Processing Privilege Actions

Privilege actions define the operations a database user or custom role can perform on stream processors within a stream processing workspace. Assign only the privilege actions a user needs to that user or to a custom role.

All privilege actions apply to the stream processing workspace as a whole. You cannot scope them to individual named processors within a stream processing workspace. All actions are valid on Atlas Stream Processing instances only.

A user with the atlasAdmin or readWriteAnyDatabase role can perform all stream processing actions. A user with the readAnyDatabase role can perform the read-only subset. For details, see Built-in Role Summary.

If a user lacks the required privilege for an action, the command returns MongoServerError[Unauthorized]: not authorized: missing privilege for action <privilege-action> on resource <resource>.

To create a custom role with specific Atlas Stream Processing privilege actions, see Add Custom Roles.

Built-in Role Summary

The following table shows built-in roles that include Atlas Stream Processing privilege actions.

Built-in Role	Included Privilege Actions
`atlasAdmin`	All Atlas Stream Processing privilege actions
`readAnyDatabase`	`getStreamProcessor`, `listStreamProcessors`, `streamProcessorStats`, `listStreamConnections`
`readWriteAnyDatabase`	All Atlas Stream Processing privilege actions

Atlas Stream Processing Actions

createStreamProcessor

Authorizes the sp.createStreamProcessor() method, which defines a new named stream processor with its pipeline and options.

Assign this action to allow users to create named stream processors before starting them.

Note

Atlas Stream Processing validates the tier format at create time. Atlas Stream Processing enforces the maximum tier size when you start the processor, not when you create it.

dropStreamProcessor

Authorizes the sp.processor.drop() method, which permanently deletes a named stream processor.

Assign this action to allow users to delete stream processors. A user with this action can delete any processor in the stream processing workspace. No mechanism restricts this action to specific named processors.

getStreamProcessor

Authorizes the getStreamProcessor command, which retrieves the state and configuration of a named stream processor. Results include name, state, pipeline, error message, and last state change time.

Assign this action to allow users to inspect a specific stream processor's state.

listStreamConnections

Authorizes the sp.listConnections() method, which lists all connections in the stream processing workspace connection registry. Depending on connection type, results can include connection name, type, cluster name, project ID, region, bootstrap servers, and storage account fields.

Assign this action to allow users to view the data sources and sinks available to stream processors in the stream processing workspace.

listStreamProcessors

Authorizes the sp.listStreamProcessors() method, which lists all stream processors in a stream processing workspace. Results can include name, ID, last modified time, state, tier, error message, worker count, pipeline, dead letter queue, and last state change time. You can pass a filter to narrow results.

Assign this action to allow users to discover all stream processors in a stream processing workspace. Drivers and tools also require this action to populate processor lists. The command returns all processors in the stream processing workspace. No mechanism restricts visibility to specific named processors.

modifyStreamProcessor

Authorizes the sp.processor.modify() method, which modifies an existing stream processor.

Assign this action to allow users to update a stream processor's configuration without deleting and recreating it.

processStreamProcessor

Authorizes the processStreamProcessor command, which runs a stream-processing pipeline in one-shot mode without creating a named processor.

Assign this action to allow users to run a pipeline in one-shot mode.

Note

To run the sp.process() mongosh method, also assign the sampleStreamProcessor privilege action. sp.process() uses the sample mechanism internally and requires both privileges.

sampleStreamProcessor

Authorizes the sp.processor.sample() method and the underlying startSampleStreamProcessor and getMoreSampleStreamProcessor commands. Use startSampleStreamProcessor to start a sampling session on a named, running stream processor. Use getMoreSampleStreamProcessor to retrieve the next batch of results. The default batch size is 5 when batchSize is 0 or omitted.

Assign this action to allow users to preview live output from a running stream processor or paginate through sampled results. The sampling session attaches to the processor's live output. The processor produces results only while running.

startStreamProcessor

Authorizes the sp.processor.start() method, which starts or resumes a named stream processor.

Assign this action to allow users to start or resume a named stream processor.

stopStreamProcessor

Authorizes the sp.processor.stop() method, which stops a running named stream processor.

Assign this action to allow users to pause or halt a running stream processor.

streamProcessorStats

Authorizes the sp.processor.stats() method, which uses the getStreamProcessorStats command to retrieve operational metrics for a stream processor. Atlas Stream Processing omits the stats document when no metrics are available. Pass verbose: true for more detail. Verbose mode requires no separate privilege.

Assign this action to allow users to monitor throughput, error rates, or operational metrics for a stream processor.

Back

Security

Monitoring