In our Ops Manager Resource Specification, it says the following for spec.backup.blockStores.mongodbUserRef.name:

spec.backup.blockStores.mongodbUserRef.name
Type: string

Required if SCRAM authentication is enabled on the blockstore database.

Name of the MongoDB user resource used to connect to the blockstore database. Deploy this user resource in the same namespace as the Ops Manager resource and with the readWriteAnyDatabase and dbAdminAnyDatabase roles.

But in fact Ops Manager will try to run serverStatus, which neither of those roles provides. Please also add a 3rd required role, clusterMonitor which grants permission to run that command.

IMO the same change should be made for the following sections as well:

• spec.backup.opLogStores.mongodbUserRef.name
• spec.backup.s3OpLogStores.mongodbUserRef.name
• spec.backup.s3Stores.mongodbUserRef.name