## All-Database Roles 

The admin database provides the following roles that apply to all databases in a mongod instance and are roughly equivalent to their single-database equivalents: 

## readAnyDatabase 

Provides the same read-only permissions as read (page 405), except it applies to all databases in the cluster. The role also provides the listDatabases (page 423) action on the cluster as a whole. 

## readWriteAnyDatabase 

Provides the same read and write permissions as readWrite (page 406), except it applies to all databases in the cluster. The role also provides the listDatabases (page 423) action on the cluster as a whole. 

## userAdminAnyDatabase 

Provides the same access to user administration operations as userAdmin (page 407), except it applies to all databases in the cluster. The role also provides the following actions on the cluster as a whole: 

• authSchemaUpgrade (page 420) 

• invalidateUserCache (page 421) 

• listDatabases (page 423) 

The role also provides the following actions on the admin.system.users (page 291) and admin.system.roles (page 291) collections on the admin database, and on legacy system.users collections from versions of MongoDB prior to 2.6: 

• collStats (page 423) 

• dbHash (page 423) 

• dbStats (page 423) 

• find (page 419) 

• killCursors (page 420) 

• planCacheRead (page 421) 

Changed in version 2.6.4: userAdminAnyDatabase (page 412) added the following permissions on the admin.system.users (page 291) and admin.system.roles (page 291) collections: 

• createIndex (page 420) 

• dropIndex (page 422) 

The userAdminAnyDatabase (page 412) role does not restrict the permissions that a user can grant. As a result, userAdminAnyDatabase (page 412) users can grant themselves privileges in excess of their cur- rent privileges and even can grant themselves all privileges , even though the role does not explicitly authorize privileges beyond user administration. This role is effectively a MongoDB system superuser (page 412). 

## dbAdminAnyDatabase 

Provides the same access to database administration operations as dbAdmin (page 406), except it applies to all databases in the cluster. The role also provides the listDatabases (page 423) action on the cluster as a whole. 

## Superuser Roles 

Several roles provide either indirect or direct system-wide superuser access. 

The following roles provide the ability to assign any user any privilege on any database, which means that users with one of these roles can assign themselves any privilege on any database: 

