What role is required to allow MongoDB db.collection.aggregate() usage? - mongodb

Question

I have a user in admin.system.users:
{
"_id" : "admin.reports",
"user" : "reports",
"db" : "admin",
"credentials" : {
"MONGODB-CR" : "hash"
},
"roles" : [
{
"role" : "read",
"db" : "mydb"
}
]
}
And I am attempting to execute this from a bash script:
mongo --quiet mongodb.production.internal/admin -ureports -p"password" <<< "
var conn = connect('localhost/mydb');
db.auth('reports', 'password');
db.Collection.aggregate([
{
\$group: {
_id: '\$itemId',
count: { \$sum: 1 }
}
},
{
\$sort: {
count: 1
}
}
], {cursor: {}}).forEach(function(line) {
print(line._id+','+line.count);
});
"
And I am getting this response from the mongodb instance:
not authorized on admin to execute command { aggregate: (amongst other very verbose but pointless output).
What permission do I need to enable the use of the aggregation command for this user? Can it not be done without enabling write access?

Answer 1

The issue was not with permissions, read is indeed sufficient, but with correctly switching to the right database.
I was using connect() to silently (no output) switch to the working db because the use command throws output. This is incorrect, and the workaround is in how you specify the connection on the command line, ie:
mongo --quiet mongodb.production.internal/mydb --authenticationDatabase admin -ureports -p"password"