[Yandex Cloud documentation](../../index.md) > [Yandex StoreDoc](../index.md) > [Step-by-step guides](index.md) > Databases > Managing database users

# Managing Yandex StoreDoc users

You can add and remove users, manage individual user settings, and change database access permissions.

## Getting a list of users {#list-users}

{% list tabs group=instructions %}

- Management console {#console}
  
  1. Open the [folder dashboard](https://console.yandex.cloud).
  1. Navigate to **Yandex StoreDoc**.
  1. Locate the cluster you need in the list, click its name, and select the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  
- CLI {#cli}
  
  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).
  
  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
  
  To get a list of cluster users, run this command:
  
  ```
  yc managed-mongodb user list \
    --cluster-name <cluster_name>
  ```
  
  You can get the cluster name with the [list of clusters in the folder](cluster-list.md#list-clusters).
  
- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Call the [User.List](../api-ref/User/list.md) method, e.g., via the following [cURL](https://curl.se/) request:

     ```bash
     curl \
       --request GET \
       --header "Authorization: Bearer $IAM_TOKEN" \
       --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users'
     ```

     You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. Check the [server response](../api-ref/User/list.md#yandex.cloud.mdb.mongodb.v1.ListUsersResponse) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService.List](../api-ref/grpc/User/list.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

     ```bash
     grpcurl \
       -format json \
       -import-path ~/cloudapi/ \
       -import-path ~/cloudapi/third_party/googleapis/ \
       -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
       -rpc-header "Authorization: Bearer $IAM_TOKEN" \
       -d '{
             "cluster_id": "<cluster_ID>"
           }' \
       mdb.api.cloud.yandex.net:443 \
       yandex.cloud.mdb.mongodb.v1.UserService.List
     ```

     You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. Check the [server response](../api-ref/grpc/User/list.md#yandex.cloud.mdb.mongodb.v1.ListUsersResponse) to make sure your request was successful.

{% endlist %}

## Creating a user {#adduser}

{% list tabs group=instructions %}

- Management console {#console}
  
  1. Open the [folder dashboard](https://console.yandex.cloud).
  1. Navigate to **Yandex StoreDoc**.

  1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **Users** tab.

  1. Click **Create user**.

  1. Enter the database user name and password.

      {% note info %}
      
      The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.
      
      The password must be between 8 and 128 characters.
      
      {% endnote %}

  1. Configure the user’s [roles](../concepts/users-and-roles.md):

     1. Click **Add database** and select the database for role assignment.
     1. Add roles using the ![image](../../_assets/console-icons/plus.svg) button.

     You can assign a user multiple roles across different databases.

  1. Click **Create**.

- CLI {#cli}
  
  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).
  
  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
  
  To create a cluster user:
  
  1. See the description of the CLI command for creating a user:
  
     ```
     yc managed-mongodb user create --help
     ```
  
  1. Specify user properties in the creation command:
     ```
     yc managed-mongodb user create <username> \
       --cluster-name <cluster_name> \
       --password <user_password> \
       --permission database=<DB_name>,role=<role>,role=<other_role>,... \
       --permission database=<other_DB_name>,role=<role>,...
     ```
  
     {% note info %}
     
     The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.
     
     The password must be between 8 and 128 characters.
     
     {% endnote %}

     You can get the cluster name from the [list of clusters in your folder](cluster-list.md#list-clusters).

- Terraform {#tf}

    1. Open the current Terraform configuration file with the infrastructure plan.

        To learn how to create this file, see [Creating a cluster](cluster-create.md).

    1. Add the `yandex_mdb_mongodb_user` resource:

        ```hcl
        resource "yandex_mdb_mongodb_user" "<username>" {
          cluster_id = <cluster_ID>
          name       = "<username>"
          password   = "<password>"
          permission {
            database_name = "<DB_name>"
            roles         = [ "<list_of_user_roles>" ]
          }
        }
        ```

        Where `database_name` is the name of the target database for user access.

        {% note info %}
        
        The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.
        
        The password must be between 8 and 128 characters.
        
        {% endnote %}

    1. Make sure the settings are correct.

        1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
        1. Run this command:
        
           ```bash
           terraform validate
           ```
        
           Terraform will show any errors found in your configuration files.

    1. Confirm updating the resources.

        1. Run this command to view the planned changes:
        
           ```bash
           terraform plan
           ```
        
           If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
        
        1. If everything looks correct, apply the changes:
           1. Run this command:
        
              ```bash
              terraform apply
              ```
        
           1. Confirm updating the resources.
           1. Wait for the operation to complete.

    For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mongodb_user.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Call the [User.Create](../api-ref/User/create.md) method, e.g., via the following [cURL](https://curl.se/) request:

     ```bash
     curl \
       --request POST \
       --header "Authorization: Bearer $IAM_TOKEN" \
       --header "Content-Type: application/json" \
       --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users' \
       --data '{
                 "userSpec": {
                   "name": "<username>",
                   "password": "<user_password>",
                   "permissions": [
                     {
                       "databaseName": "<DB_name>",
                       "roles": [
                        "<role_1>", "<role_2>", ..., "<role_N>"
                       ]
                     }
                   ]
                 }
               }'
     ```

     Where `userSpec` are the settings for the new database user:

     * `name`: Username.
     * `password`: Password.

       {% note info %}
       
       The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.
       
       The password must be between 8 and 128 characters.
       
       {% endnote %}

     * `permissions`: User permissions:

       * `databaseName`: Name of the database the user can access.
       * `roles`: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see [Users and roles](../concepts/users-and-roles.md).

       In the `permissions` array, add a separate element with permission settings for each database.

     You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. Check the [server response](../api-ref/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService.Create](../api-ref/grpc/User/create.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

     ```bash
     grpcurl \
       -format json \
       -import-path ~/cloudapi/ \
       -import-path ~/cloudapi/third_party/googleapis/ \
       -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
       -rpc-header "Authorization: Bearer $IAM_TOKEN" \
       -d '{
             "cluster_id": "<cluster_ID>",
             "user_spec": {
               "name": "<username>",
               "password": "<user_password>",
               "permissions": [
                 {
                   "database_name": "<DB_name>",
                   "roles": [
                      "<role_1>", "<role_2>", ..., "<role_N>"
                   ]   
                 }
               ]
             }
           }' \
       mdb.api.cloud.yandex.net:443 \
       yandex.cloud.mdb.mongodb.v1.UserService.Create
     ```

     Where `user_spec` are the settings for the new database user:

     * `name`: Username.
     * `password`: Password.

          {% note info %}
          
          The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.
          
          The password must be between 8 and 128 characters.
          
          {% endnote %}

     * `permissions`: User permissions:

       * `database_name`: Name of the database the user can access.
       * `roles`: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see [Users and roles](../concepts/users-and-roles.md).

       In the `permissions` array, add a separate element with permission settings for each database.

     You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. Check the [server response](../api-ref/grpc/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Changing the user password and role {#updateuser}

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [folder dashboard](https://console.yandex.cloud).
  1. Navigate to **Yandex StoreDoc**.

  1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **Users** tab.

  
  1. To change a user’s password, locate the user in the list, click ![image](../../_assets/console-icons/ellipsis.svg) in their row, and select **Change password**.
  
     * **Enter manually**: Set your own password. It must be from 8 to 128 characters long.
     * **Generate**: Generate a password using [Connection Manager](cluster-create.md#conn-man).

        To view the new password, navigate to the cluster page, select the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. The new password version is marked as **Current**.

     To view passwords, you need the `lockbox.payloadViewer` role.


  1. To change the user's [roles](../concepts/users-and-roles.md):

     1. Locate the user you need in the list, click ![image](../../_assets/console-icons/ellipsis.svg) in their row, and select **Configure**.
     1. To add a role, click ![image](../../_assets/console-icons/plus.svg) next to the target database and select the role you want to assign.
     1. To delete a role, click ![image](../../_assets/console-icons/xmark.svg) next to its name.

  1. Click **Save**.

- CLI {#cli}
  
  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).
  
  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
  
  To change a user's password or role assignments:
  
  1. See the description of the CLI command for updating a user:
  
     ```
     yc managed-mongodb user update --help
     ```
  
  1. Specify user properties in the `user update` command:
     ```
     yc managed-mongodb user update <username> \
       --cluster-name <cluster_name> \
       --password <user_password> \
       --permission database=<DB_name>,role=<role>,role=<other_role>,... \
       --permission database=<other_DB_name>,role=<role>,...
     ```
  
     {% note info %}
     
     
     The password must be from 8 to 128 characters long.
     
     
     {% endnote %}

  To grant a user access to a database with a specific set of roles:

  1. See the description of the CLI command for granting user permissions:
  
     ```
     yc managed-mongodb user grant-permission --help
     ```
  
  1. Specify user properties in the `user grant permission` command:

     ```bash
     yc managed-mongodb user grant-permission <username> \
       --cluster-name <cluster_name> \
       --database <DB_name> \
       --role <list_of_roles_separated_by_commas>
     ```

  To revoke database access from a user:

  1. See the description of the CLI command for revoking user permissions:
  
     ```
     yc managed-mongodb user revoke-permission --help
     ```
  
  1. Specify user properties in the `user revoke permission` command:

     ```bash
     yc managed-mongodb user revoke-permission <username> \
       --cluster-name <cluster_name> \
       --database <DB_name>
     ```

      This command revokes the user’s access to the specified database.

  You can get the cluster’s name from the [list of clusters in your folder](cluster-list.md#list-clusters), the database name from the [list of your cluster databases](databases.md#list-db), and the user's name from the [list of cluster users](cluster-users.md#list-users).

- Terraform {#tf}

    1. Open the current Terraform configuration file with the infrastructure plan.

        To learn how to create this file, see [Creating a cluster](cluster-create.md).

    1. Locate the `yandex_mdb_mongodb_user` resource.
    1. Update the `password` and `permission` settings:

        ```hcl
        resource "yandex_mdb_mongodb_user" "<username>" {
          cluster_id = <cluster_ID>
          name       = "<username>"
          password   = "<new_password>"
          permission {
            database_name = "<DB_name>"
            roles         = [ "<new_list_of_user_roles>" ]
          }
        }
        ```

        {% note info %}
        
        
        The password must be from 8 to 128 characters long.
        
        
        {% endnote %}

    1. Make sure the settings are correct.
  
        1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
        1. Run this command:
        
           ```bash
           terraform validate
           ```
        
           Terraform will show any errors found in your configuration files.

    1. Confirm updating the resources.

        1. Run this command to view the planned changes:
        
           ```bash
           terraform plan
           ```
        
           If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
        
        1. If everything looks correct, apply the changes:
           1. Run this command:
        
              ```bash
              terraform apply
              ```
        
           1. Confirm updating the resources.
           1. Wait for the operation to complete.

    For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mongodb_user.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Call the [User.Update](../api-ref/User/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

     {% note warning %}
     
     The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
     
     {% endnote %}

     ```bash
     curl \
       --request PATCH \
       --header "Authorization: Bearer $IAM_TOKEN" \
       --header "Content-Type: application/json" \
       --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users/<username>' \
       --data '{
                "updateMask": "password,permissions.databaseName,permissions.roles",
                "password": "<user_password>",
                "permissions": [
                  {
                    "databaseName": "<DB_name>",
                    "roles": [
                      "<role_1>", "<role_2>", ..., "<role_N>"
                    ]
                  }
                ]
              }'
     ```                

     Where:

     * `updateMask`: Comma-separated list of settings you want to update.
     * `password`: Password.

        {% note info %}
        
        The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.
        
        The password must be between 8 and 128 characters.
        
        {% endnote %}

     * `permissions`: User permissions:

       * `database_name`: Name of the database the user can access.
       * `roles`: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see [Users and roles](../concepts/users-and-roles.md).
 
     You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService.Update](../api-ref/grpc/User/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

     {% note warning %}
     
     The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `update_mask` parameter as an array of `paths[]` strings.
     
     {% cut "Format for listing settings" %}
     
     ```yaml
     "update_mask": {
         "paths": [
             "<setting_1>",
             "<setting_2>",
             ...
             "<setting_N>"
         ]
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

     ```bash
     grpcurl \
       -format json \
       -import-path ~/cloudapi/ \
       -import-path ~/cloudapi/third_party/googleapis/ \
       -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
       -rpc-header "Authorization: Bearer $IAM_TOKEN" \
       -d '{
             "cluster_id": "<cluster_ID>",
             "user_name": "<username>",
             "update_mask": {
               "paths": [
                 "password",
                 "permissions.database_name",
                 "permissions.roles"
               ]
             },
             "password": "<user_password>",
             "permissions": [
               {
                 "database_name": "<DB_name>",
                 "roles": [
                   "<role_1>", "<role_2>", ..., "<role_N>"
                 ]
               }
             ]
           }' \
       mdb.api.cloud.yandex.net:443 \
       yandex.cloud.mdb.mongodb.v1.UserService.Update
     ```

     Where:

     * `update_mask`: Comma-separated list of settings you want to update.
     * `password`: Password.

        {% note info %}
        
        The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter, number, or underscore.
        
        The password must be between 8 and 128 characters.
        
        {% endnote %}

     * `permissions`: User permissions:

       * `database_name`: Name of the database the user can access.
       * `roles`: Array of user roles. Each role is provided as a separate string in the array. For the list of possible values, see [Users and roles](../concepts/users-and-roles.md).

     You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/grpc/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful. 

{% endlist %}

## Deleting a user {#removeuser}

{% list tabs group=instructions %}

- Management console {#console}
  
  1. Open the [folder dashboard](https://console.yandex.cloud).
  1. Navigate to **Yandex StoreDoc**.
  1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Locate the user you need in the list, click ![image](../../_assets/console-icons/ellipsis.svg) in their row, and select **Delete**.
  
- CLI {#cli}
  
  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).
  
  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
  
  To delete a user, run this command:
  
  ```
  yc managed-mongodb user delete <username> \
    --cluster-name <cluster_name>
  ```
  
  You can get the cluster name with the [list of clusters in the folder](cluster-list.md#list-clusters).

- Terraform {#tf}

    1. Open the current Terraform configuration file with the infrastructure plan.

        To learn how to create this file, see [Creating a cluster](cluster-create.md).

    1. Delete the `yandex_mdb_mongodb_user` resource with the target user’s description.

    1. Make sure the settings are correct.

        1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
        1. Run this command:
        
           ```bash
           terraform validate
           ```
        
           Terraform will show any errors found in your configuration files.

    1. Confirm updating the resources.

        1. Run this command to view the planned changes:
        
           ```bash
           terraform plan
           ```
        
           If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
        
        1. If everything looks correct, apply the changes:
           1. Run this command:
        
              ```bash
              terraform apply
              ```
        
           1. Confirm updating the resources.
           1. Wait for the operation to complete.

    For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mongodb_user.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Call the [User.Delete](../api-ref/User/delete.md) method, e.g., via the following [cURL](https://curl.se/) request:

     ```bash
     curl \
       --request DELETE \
       --header "Authorization: Bearer $IAM_TOKEN" \
       --url 'https://mdb.api.cloud.yandex.net/managed-mongodb/v1/clusters/<cluster_ID>/users/<username>'
     ```

     You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/User/delete.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

     ```bash
     export IAM_TOKEN="<IAM_token>"
     ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService.Delete](../api-ref/grpc/User/delete.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

     ```bash
     grpcurl \
       -format json \
       -import-path ~/cloudapi/ \
       -import-path ~/cloudapi/third_party/googleapis/ \
       -proto ~/cloudapi/yandex/cloud/mdb/mongodb/v1/user_service.proto \
       -rpc-header "Authorization: Bearer $IAM_TOKEN" \
       -d '{
             "cluster_id": "<cluster_ID>",
             "user_name": "<username>"
           }' \
       mdb.api.cloud.yandex.net:443 \
       yandex.cloud.mdb.mongodb.v1.UserService.Delete
     ```

     You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/grpc/User/delete.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Examples {#examples}

### Add a user with read-only permissions {#user-read-only}

To add a new `user2` account with read-only access for the `db1` database to an existing cluster:

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [folder dashboard](https://console.yandex.cloud).
  1. Navigate to **Yandex StoreDoc**.
  1. Click the cluster name and open the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Click **Create user**.
  1. Enter `user2` for username and enter a password (from 8 to 128 characters).
  1. Select the `db1` database from the **Add database** drop-down list.
  1. Select the `read` role from the drop-down list next to the `db1` database.
  1. Click **Create**.

- CLI {#cli}

  Run this command:

  ```
  yc managed-mongodb user create user2 \
    --cluster-name <cluster_name> \
    --password <user_password> \
    --permission database=db1,role=read
  ```

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.

      For more on how to create this file, see [Creating a cluster](cluster-create.md).

  1. Add the `yandex_mdb_mongodb_user` resource:

      ```hcl
      resource "yandex_mdb_mongodb_user" "user2" {
        cluster_id = <cluster_ID>
        name       = "user2"
        password   = "<password>"
        permission {
          database_name = "db1"
          roles         = [ "read" ]
        }
      }
      ```

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm updating the resources.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mongodb_user.md).

{% endlist %}

### Modify user permissions {#update-user-read-only}

To grant read-only access to the `db2` database to an existing `cluster1` user named `user1`:

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [folder dashboard](https://console.yandex.cloud).
  1. Navigate to **Yandex StoreDoc**.
  1. Click `cluster1` and select the ![image](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Click ![image](../../_assets/console-icons/ellipsis.svg) in the row with `user1` and select **Configure**.
  1. Click **Add database** and select `db2` as your database.
  1. Click ![image](../../_assets/console-icons/plus.svg) and select the `read` role from the drop-down list next to the `db2` database.
  1. Click **Save**.

- CLI {#cli}

  Run this command:

  ```
  yc managed-mongodb user grant-permission user1 \
    --cluster-name cluster1 \
    --database db2 \
    --role read
  ```

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.

      For more on how to create this file, see [Creating a cluster](cluster-create.md).

  1. Locate the `yandex_mdb_mongodb_user` resource.
  1. Add the `permission` section:

      ```hcl
      resource "yandex_mdb_mongodb_user" "user1" {
        cluster_id = <cluster_ID>
        name       = "user1"
        password   = "<password>"
        permission {
          database_name = "db2"
          roles         = [ "read" ]
        }
      }
      ```

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm updating the resources.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mongodb_user.md).

{% endlist %}