notebooks/atlas_user_auth_and_rbac.ipynb

{
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "QFdG4eYf3h0L"
      },
      "source": [
        "[![Open In Colab](https://colab.research.google.com/assets/colab-badge.svg)](https://colab.research.google.com/github/mongodb-developer/Security-Showcase/blob/main/notebooks/atlas_user_auth_and_rbac.ipynb)\n"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "M1Z1HCnhstoM"
      },
      "source": [
        "# MongoDB Atlas User Authentication, Project Management, and Role-Based Access Control\n",
        "\n",
        "This notebook demonstrates how to authenticate with the Atlas CLI, create projects and clusters, and implement user authentication and role-based access control in MongoDB Atlas using X509 certificates and User/Password authentication methods.\n",
        "\n",
        "## Prerequisites\n",
        "\n",
        "1. MongoDB Atlas account\n",
        "2. Atlas CLI installed\n"
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "# prompt: Install Atlas CLI using this link https://fastdl.mongodb.org/mongocli/mongodb-atlas-cli_1.29.0_linux_x86_64.deb\n",
        "\n",
        "!wget https://fastdl.mongodb.org/mongocli/mongodb-atlas-cli_1.29.0_linux_x86_64.deb\n",
        "!dpkg -i mongodb-atlas-cli_1.29.0_linux_x86_64.deb\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "US-eopsbs4U3",
        "outputId": "616fac51-6dcd-4f8f-a8d5-4476b18ae407"
      },
      "execution_count": 3,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "--2024-10-01 10:51:59--  https://fastdl.mongodb.org/mongocli/mongodb-atlas-cli_1.29.0_linux_x86_64.deb\n",
            "Resolving fastdl.mongodb.org (fastdl.mongodb.org)... 108.156.152.3, 108.156.152.61, 108.156.152.53, ...\n",
            "Connecting to fastdl.mongodb.org (fastdl.mongodb.org)|108.156.152.3|:443... connected.\n",
            "HTTP request sent, awaiting response... 200 OK\n",
            "Length: 20935008 (20M) [application/x-gzip]\n",
            "Saving to: ‘mongodb-atlas-cli_1.29.0_linux_x86_64.deb.1’\n",
            "\n",
            "mongodb-atlas-cli_1 100%[===================>]  19.96M   113MB/s    in 0.2s    \n",
            "\n",
            "2024-10-01 10:51:59 (113 MB/s) - ‘mongodb-atlas-cli_1.29.0_linux_x86_64.deb.1’ saved [20935008/20935008]\n",
            "\n",
            "\u001b[1mdpkg:\u001b[0m \u001b[1;31merror:\u001b[0m cannot access archive 'mongodb-atlas-cli_latest_linux_x86_64.deb': No such file or directory\n"
          ]
        }
      ]
    },
    {
      "cell_type": "markdown",
      "source": [],
      "metadata": {
        "id": "Ah2EQNVmuYYh"
      }
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "0oHSQzm3stoM"
      },
      "source": [
        "## 1. Atlas CLI Authentication\n",
        "\n",
        "First, let's authenticate with the Atlas CLI using your web browser."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 4,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "6qlFy-wBstoN",
        "outputId": "4cf70627-e691-444d-80db-450ffe66fe13"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\n",
            "To verify your account, copy your one-time verification code:\n",
            "9M4V-3FTD\n",
            "\n",
            "Paste the code in the browser when prompted to activate your Atlas CLI. Your code will expire after 10 minutes.\n",
            "\n",
            "To continue, go to https://account.mongodb.com/account/connect\n",
            "/usr/bin/xdg-open: 882: www-browser: not found\n",
            "/usr/bin/xdg-open: 882: links2: not found\n",
            "/usr/bin/xdg-open: 882: elinks: not found\n",
            "/usr/bin/xdg-open: 882: links: not found\n",
            "/usr/bin/xdg-open: 882: lynx: not found\n",
            "/usr/bin/xdg-open: 882: w3m: not found\n",
            "xdg-open: no method available for opening 'https://account.mongodb.com/account/connect'\n",
            "There was an issue opening your browser\n",
            "Successfully logged in as pavel.duchovny@mongodb.com.\n",
            "\u001b[KSelect one default organization and one default project.\n",
            "\u001b7\u001b[?25l\u001b8\u001b[0G\u001b[2K\u001b[0;1;92m? \u001b[0m\u001b[0;1;99mChoose a default organization:\u001b[0m  \u001b[0;36m[Use arrows to move, type to filter]\u001b[0m\n",
            "\u001b[0;1;36m> 60531ad03394206878026140 - \u001b[0;36mDataLakesTests\u001b[0m\n",
            "\u001b[0;39m  5c548814ff7a25e1ae98fa94 - \u001b[0;36mDeveloper Relations\u001b[0m\n",
            "\u001b[0;39m  5b2bc5d24e65810d11cb123e - \u001b[0;36mMDB-EngComms-Demos\u001b[0m\n",
            "\u001b[0;39m  6065e0a402578658c9a08cf3 - \u001b[0;36mMongoDB Internal Serverless Private Beta\u001b[0m\n",
            "\u001b[0;39m  5a84c62e9701993284f0a393 - \u001b[0;36mMongoDB-Products-Team\u001b[0m\n",
            "\u001b[0;39m  59db7b92c0c6e3621d8e1c6d - \u001b[0;36mMyOrgPavel\u001b[0m\n",
            "\u001b[0;39m  604f63aeb49bf25a0c8093f2 - \u001b[0;36mReuven\u001b[0m\n",
            "\u001b7\u001b[1A\u001b[0G\u001b[1A\u001b[0G\u001b[1A\u001b[0G\u001b[1A\u001b[0G\u001b[1A\u001b[0G\u001b[1A\u001b[0G\u001b[1A\u001b[0G"
          ]
        }
      ],
      "source": [
        "# Authenticate with Atlas CLI\n",
        "!atlas auth login"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "qr5uWMKdstoN"
      },
      "source": [
        "If you use Google collab I recommend opening the prompted URL and inputing the provided token. Once authenticated stop the task."
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "IkAuf7C-stoN"
      },
      "source": [
        "## 2. Creating Projects and Clusters\n",
        "\n",
        "Now that we're authenticated, let's create a new project and cluster."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 9,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "eOA6y7_gstoN",
        "outputId": "d0259c85-1672-4cf6-f026-ba3889221c40"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Enter your org ID: ··········\n",
            "Project '66fbd62c6e3d955383c69afe' created.\n"
          ]
        }
      ],
      "source": [
        "# Create a new project\n",
        "import getpass\n",
        "\n",
        "org_id = getpass.getpass('Enter your org ID: ')\n",
        "!atlas projects create MySecureProj --orgId {org_id}"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 12,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "Dn9i0yiEstoN",
        "outputId": "c074714d-adaa-4740-fa27-d1e95a31df5d"
      },
      "outputs": [
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "Enter your project ID: ··········\n"
          ]
        }
      ],
      "source": [
        "# Create a new cluster in the project\n",
        "project_id = getpass.getpass('Enter your project ID: ')\n",
        "!atlas clusters create MyNewCluster --provider AWS --region US_EAST_1 --tier M0 --projectId {project_id}"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "TBeVxeJystoN"
      },
      "source": [
        "Replace `your_project_id` with the ID of the project you just created. This command creates a new M0 cluster on AWS in the US East region. Adjust the parameters as needed for your use case."
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "L1jV4YozstoN"
      },
      "source": [
        "## 3. User/Password Authentication\n",
        "\n",
        "Let's create a user with User/Password authentication and assign roles."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 14,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "6BS6gEhhstoN",
        "outputId": "34277ac0-7b2a-415d-f09d-d4d08e9cdbd7"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Database user 'myUser' successfully created.\n"
          ]
        }
      ],
      "source": [
        "# Create a new database user with read and write roles\n",
        "!atlas dbusers create --username myUser --password mySecurePassword --role readWriteAnyDatabase --projectId {project_id}"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "XmRpSLpnstoN"
      },
      "source": [
        "This command creates a new user named 'myUser' with the password 'mySecurePassword' and assigns the 'readWriteAnyDatabase' role, which allows read and write access to all databases in the cluster."
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "## Test a connection using the username/password\n",
        "\n",
        "1. Add 'My current IP' temporary into the atlas project"
      ],
      "metadata": {
        "id": "1OMe6FUtvypA"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "\n",
        "from datetime import datetime, timedelta\n",
        "\n",
        "# Calculate the date and time 24 hours from now\n",
        "delete_after = (datetime.utcnow() + timedelta(hours=24)).isoformat() + 'Z'\n",
        "\n",
        "\n",
        "\n",
        "!atlas accessLists create --currentIp --projectId {project_id} --deleteAfter \"{delete_after}\"\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "e6VARRRmwDIT",
        "outputId": "2c47cfed-99b1-45df-9ed3-f1ad9f41f974"
      },
      "execution_count": 21,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Created a new IP access list.\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!pip install pymongo dnspython"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "013EfD-B0qNE",
        "outputId": "13fda86b-c846-4b76-b616-c6c2edde87ef"
      },
      "execution_count": 28,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Collecting pymongo\n",
            "  Downloading pymongo-4.10.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.metadata (22 kB)\n",
            "Collecting dnspython\n",
            "  Downloading dnspython-2.6.1-py3-none-any.whl.metadata (5.8 kB)\n",
            "Downloading pymongo-4.10.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (1.4 MB)\n",
            "\u001b[2K   \u001b[90m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\u001b[0m \u001b[32m1.4/1.4 MB\u001b[0m \u001b[31m17.3 MB/s\u001b[0m eta \u001b[36m0:00:00\u001b[0m\n",
            "\u001b[?25hDownloading dnspython-2.6.1-py3-none-any.whl (307 kB)\n",
            "\u001b[2K   \u001b[90m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\u001b[0m \u001b[32m307.7/307.7 kB\u001b[0m \u001b[31m19.4 MB/s\u001b[0m eta \u001b[36m0:00:00\u001b[0m\n",
            "\u001b[?25hInstalling collected packages: dnspython, pymongo\n",
            "Successfully installed dnspython-2.6.1 pymongo-4.10.0\n"
          ]
        }
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "2. Get the atlas connection string and use it"
      ],
      "metadata": {
        "id": "1qtW3xFYzSJh"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "connection = !atlas clusters connectionStrings describe  MyNewCluster --projectId {project_id}\n",
        "\n",
        "username = 'myUser'\n",
        "password = 'mySecurePassword'\n",
        "\n",
        "new_connection = connection[1].replace('mongodb+srv://', f'mongodb+srv://{username}:{password}@')\n",
        "print(new_connection)\n",
        "\n",
        "from pymongo import MongoClient\n",
        "client = MongoClient(new_connection)\n",
        "\n",
        "client.list_database_names()\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "a22yhJdozR7J",
        "outputId": "119b09aa-cc69-47ba-c165-c607763247d8"
      },
      "execution_count": 29,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "mongodb+srv://myUser:mySecurePassword@mynewcluster.ajhx3.mongodb.net\n"
          ]
        },
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "['admin', 'local']"
            ]
          },
          "metadata": {},
          "execution_count": 29
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "RWEYaeZEstoN"
      },
      "source": [
        "## 4. X509 Certificate Authentication\n",
        "\n",
        "Now, let's create a user that authenticates using an X509 certificate."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 30,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "xWuj9ywdstoO",
        "outputId": "ae79f4e6-ecdd-4720-d5a8-e457c91a7e01"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Database user 'myX509User' successfully created.\n"
          ]
        }
      ],
      "source": [
        "# Generate an X509 certificate for a new user\n",
        "!atlas dbusers create --username myX509User --x509Type MANAGED --role readAnyDatabase --projectId {project_id}"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "NHUMg5hSstoO"
      },
      "source": [
        "This command creates a new user named 'myX509User' with a managed X509 certificate and assigns the 'readAnyDatabase' role, which allows read access to all databases in the cluster.\n",
        "\n",
        "After running this command, Atlas can now generate and manage the X509 certificate for this user."
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "## Lets use the X509"
      ],
      "metadata": {
        "id": "s3UE1vJc1pUc"
      }
    },
    {
      "cell_type": "markdown",
      "source": [
        "The code creates a certificate, saves it and then passes it to the driver"
      ],
      "metadata": {
        "id": "U2h-cELz6JVH"
      }
    },
    {
      "cell_type": "code",
      "source": [
        "# Generate and save the certificate\n",
        "!atlas dbusers certs create --username myX509User --monthsUntilExpiration 1 --projectId {project_id} > /tmp/cert.pem\n",
        "\n",
        "# Update the connection string\n",
        "username='myX509User'\n",
        "connection = !atlas clusters connectionStrings describe MyNewCluster --projectId {project_id}\n",
        "new_connection = connection[1].replace('.net', '.net?authSource=%24external&authMechanism=MONGODB-X509&retryWrites=true&w=majority&appName=MyNewCluster')\n",
        "print(new_connection)\n",
        "\n",
        "# Connect using the certificate\n",
        "from pymongo import MongoClient\n",
        "client = MongoClient(new_connection,\n",
        "                     tlsCertificateKeyFile='/tmp/cert.pem')\n",
        "\n",
        "# Access the database\n",
        "client.list_database_names()\n",
        "\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "P6E1b7yU3RB4",
        "outputId": "b40b2f99-b80d-4224-942b-2649304e7029"
      },
      "execution_count": 52,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "mongodb+srv://mynewcluster.ajhx3.mongodb.net?authSource=%24external&authMechanism=MONGODB-X509&retryWrites=true&w=majority&appName=MyNewCluster\n"
          ]
        },
        {
          "output_type": "execute_result",
          "data": {
            "text/plain": [
              "['admin', 'local']"
            ]
          },
          "metadata": {},
          "execution_count": 52
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [],
      "metadata": {
        "id": "Sl7th0eH1IIh"
      },
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "MZEvXp7ostoO"
      },
      "source": [
        "## 5. Role-Based Access Control (RBAC)\n",
        "\n",
        "Let's explore how to assign different roles to users for fine-grained access control."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 55,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "7LCsMLFustoO",
        "outputId": "1632a456-d1b2-4302-d8e2-fd13dff6eaff"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Database user 'dbAdmin' successfully created.\n"
          ]
        }
      ],
      "source": [
        "# Create a user with specific database access\n",
        "!atlas dbusers create --username dbAdmin --password secureAdminPass --role readWriteAnyDatabase --scope 'MyNewCluster'  --projectId {project_id}"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "Yo79WHJ4stoO"
      },
      "source": [
        "This command creates a user 'readWriteAnyDatabase' with database read/write  privileges, but only for the 'MyNewCluster' database."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 58,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "nQG07bEOstoO",
        "outputId": "70104372-9c59-4182-bf84-3ce805181680"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Error: https://cloud.mongodb.com/api/atlas/v2/groups/66fbd62c6e3d955383c69afe/customDBRoles/roles POST: HTTP 409 Conflict (Error code: \"ATLAS_CUSTOM_ROLE_NAME_ALREADY_EXISTS\") Detail: A custom role with the name salesRead already exists. Reason: Conflict. Params: [salesRead]\n",
            "Database user 'readOnlyUser' successfully created.\n"
          ]
        }
      ],
      "source": [
        "# Create a user with read-only access to a specific database\n",
        "!atlas customDbRoles create salesRead --inheritedRole read@salesDB --projectId {project_id}\n",
        "!atlas dbusers create --username readOnlyUser --password readOnlyPass --role salesRead --projectId {project_id}"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "qxUo2bAIstoO"
      },
      "source": [
        "This command creates a user 'readOnlyUser' with read-only access to the 'salesDB' database."
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "# prompt: Lets try to insert data into the salesDB with a readonly user\n",
        "\n",
        "# Assuming you have the connection string and credentials for the readOnlyUser\n",
        "username = 'readOnlyUser'\n",
        "password = 'readOnlyPass'\n",
        "\n",
        "connection = !atlas clusters connectionStrings describe MyNewCluster --projectId {project_id}\n",
        "new_connection = connection[1].replace('mongodb+srv://', f'mongodb+srv://{username}:{password}@')\n",
        "\n",
        "client = MongoClient(new_connection)\n",
        "db = client['salesDB']\n",
        "collection = db['mycollection']\n",
        "\n",
        "try:\n",
        "  # Attempt to insert data\n",
        "  data = {'name': 'John Doe', 'age': 30}\n",
        "  result = collection.insert_one(data)\n",
        "  print(f\"Inserted document with ID: {result.inserted_id}\")\n",
        "except Exception as e:\n",
        "  print(f\"Error inserting data: {e}\")\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "SmchHWeC7lJN",
        "outputId": "a0d4a6b3-ccc5-444a-d387-1f36df52ccd7"
      },
      "execution_count": 59,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Error inserting data: user is not allowed to do action [insert] on [salesDB.mycollection], full error: {'ok': 0, 'errmsg': 'user is not allowed to do action [insert] on [salesDB.mycollection]', 'code': 8000, 'codeName': 'AtlasError'}\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "# prompt: Use the readWriteAnyDatabase user dbAdmin to succeed\n",
        "\n",
        "# Assuming you have the connection string and credentials for the readOnlyUser\n",
        "username = 'dbAdmin'\n",
        "password = 'secureAdminPass'\n",
        "\n",
        "connection = !atlas clusters connectionStrings describe MyNewCluster --projectId {project_id}\n",
        "new_connection = connection[1].replace('mongodb+srv://', f'mongodb+srv://{username}:{password}@')\n",
        "\n",
        "client = MongoClient(new_connection)\n",
        "db = client['salesDB']\n",
        "collection = db['mycollection']\n",
        "\n",
        "try:\n",
        "  # Attempt to insert data\n",
        "  data = {'name': 'John Doe', 'age': 30}\n",
        "  result = collection.insert_one(data)\n",
        "  print(f\"Inserted document with ID: {result.inserted_id}\")\n",
        "except Exception as e:\n",
        "  print(f\"Error inserting data: {e}\")\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "dV8w2w8T-NVo",
        "outputId": "1db33261-cc2c-430f-ad19-90ac15b19f09"
      },
      "execution_count": 60,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Inserted document with ID: 66fbe5b9e2dda5f9a5a4bdd9\n"
          ]
        }
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "i36ThCQ9stoO"
      },
      "source": [
        "## 6. Viewing and Managing Users\n",
        "\n",
        "You can view and manage existing users using the Atlas CLI."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 61,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "eChopxeRstoO",
        "outputId": "8895418a-375f-4248-a1e3-f2f73a5080b9"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "USERNAME       DATABASE\n",
            "myUser         admin\n",
            "myX509User     $external\n",
            "dbAdmin        admin\n",
            "readOnlyUser   admin\n"
          ]
        }
      ],
      "source": [
        "# List all database users\n",
        "!atlas dbusers list --projectId {project_id}"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "DwbdBR46stoO"
      },
      "source": [
        "## 7. Modifying User Roles\n",
        "\n",
        "You can update user roles as needed."
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 63,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "COh-6C_6stoO",
        "outputId": "b97f429b-7d94-4650-e742-1c899aeed681"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Successfully updated database user 'myUser'.\n"
          ]
        }
      ],
      "source": [
        "# Update user roles\n",
        "!atlas dbusers update myUser --role readWriteAnyDatabase,dbAdminAnyDatabase --projectId {project_id}"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "CWfEQ1SGstoO"
      },
      "source": [
        "This command updates the roles for 'myUser' to include both read-write access and database administration privileges for all databases."
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "EfaX2EOIstoO"
      },
      "source": [
        "## Conclusion\n",
        "\n",
        "This notebook demonstrated how to authenticate with the Atlas CLI, create projects and clusters, and manage user authentication in MongoDB Atlas using both User/Password and X509 certificate methods. We also explored role-based access control to provide fine-grained permissions to users.\n",
        "\n",
        "Remember to always follow security best practices:\n",
        "1. Use strong, unique passwords for each user\n",
        "2. Implement the principle of least privilege when assigning roles\n",
        "3. Regularly review and audit user access\n",
        "4. Use X509 certificates for enhanced security when possible\n",
        "5. Keep your Atlas CLI authentication credentials secure\n",
        "\n",
        "For more information, refer to the [MongoDB Atlas documentation](https://docs.atlas.mongodb.com/)."
      ]
    }
  ],
  "metadata": {
    "kernelspec": {
      "display_name": "Python 3",
      "language": "python",
      "name": "python3"
    },
    "language_info": {
      "codemirror_mode": {
        "name": "ipython",
        "version": 3
      },
      "file_extension": ".py",
      "mimetype": "text/x-python",
      "name": "python",
      "nbconvert_exporter": "python",
      "pygments_lexer": "ipython3",
      "version": "3.8.5"
    },
    "colab": {
      "provenance": []
    }
  },
  "nbformat": 4,
  "nbformat_minor": 0
}