I want to create a user with particular "find" access only on a collection & tried below process.

Process 1:

Use admin ..............................Success
db.createRole(
{
role: "DeveloperRole",
privileges: [
{ resource:

{ db: "mydb", collection: "coll1" }

, actions: [ "find"] }
],
roles: []
}
)
.........................success
db.createUser(
{
user: "perfDeveloper",
pwd: "mongo123",
roles: [

{ role: "DeveloperRole", db: "mydb" }

]
}
)
......error No role named DeveloperRole@mydb

Process 2:

Use admin ..............................Success
Use mydb ..............................Success

db.createRole(
{
role: "DeveloperRole",
privileges: [
{ resource:

{ db: "mydb", collection: "coll1" }

, actions: [ "find"] }
],
roles: []
}
)
.........................success
db.createUser(
{
user: "perfDeveloper",
pwd: "mongo123",
roles: [

{ role: "DeveloperRole", db: "mydb" }

]
}
)
......success

But now user perfDeveloper is able to insert or remove data also, which I didn't provide access for.