We can't seem to find any conclusive document on what permissions (user roles) are required to run mongodump on a specific db.
Say I have a db named x and a user y on it with following roles roles: [ "readWrite", "dbAdmin" ], as well as 2 users a and b on admin collection with roles: [ "userAdminAnyDatabase" ] and roles: [ "dbAdminAnyDatabase" ], it seems none of them has the right permission to run mongodump:
mongodump --db x --username y --password --authenticationDatabase x
Tue Dec 10 17:04:23.901 x.system.users to dump/x/system.users.bson
assertion: 11010 count fails:{ ok: 0.0, errmsg: "unauthorized" }
mongodump --db x --username a --password --authenticationDatabase admin
Tue Dec 10 17:06:19.674 DATABASE: x to dump/x
assertion: 13106 nextSafe(): { $err: "not authorized for query on x.system.indexes", code: 16550 }
mongodump --db x --username b --password --authenticationDatabase admin
Tue Dec 10 17:08:20.678 DATABASE: x to dump/x
assertion: 13106 nextSafe(): { $err: "not authorized for query on x.system.namespaces", code: 16550 }
We must be missing something obvious, but what does mongodump look for when dumping a database and what permission does it need?
PS: as a bonus, we would like to figure out what user roles are needed to dump a specific collection, as well as all db(s).