services / Azure / Cosmos DB MongoDB role definition

A MongoDB Role Definition is a data-plane RBAC role for the Cosmos DB for MongoDB API, specifying the set of database privileges (actions/resources) that can be granted to user definitions.

Defines the data-plane access-control model for a single database account's data store.

Microsoft.​DocumentDB/​databaseAccounts/​mongodbRoleDefinitions/​delete

Deleting a MongoDB role definition removes a data-plane access-control policy object and breaks every user assignment referencing it, revoking authorized database access and disrupting the RBAC model.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links