Restricting a managed identity's access to Azure Cosmos DB for MongoDB account (RU)

Question

I have 5 container apps with that each have a user managed identity. Each of the container apps uses their identity to connect to a Azure Cosmos DB for MongoDB account (RU) database by having a read access to a key vault that contains the primary connection string.

Is it possible to restrict the access of the user managed identities to a specific database/collection within the Azure Cosmos DB for MongoDB account? What is considered a best practice in this case so the managed identities don't have access to everything?

Answer 1

Hello Boyan Stefanov,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to restrict a managed identity's access to Azure Cosmos DB for MongoDB account (RU).

Solution

To restrict user-managed identities access in Azure Cosmos DB for MongoDB, best practices is to create a custom Role in your Azure Active Directory (AAD), then assign this custom role to the user-managed identities used by your container apps.

Other method and references that support best practices:

To read more about other methods supported by best practices, kindly use the below links:

• Configuring role-based access control in Azure Cosmos DB for MongoDB: https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/how-to-setup-rbac
• Restricting user access to data operations in Azure Cosmos DB: https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-restrict-user-data
• GitHub - Restrict user access to data operations in Azure Cosmos DB: https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/cosmos-db/how-to-restrict-user-data.md
• Azure role-based access control in Azure Cosmos DB: https://learn.microsoft.com/en-us/azure/cosmos-db/role-based-access-control

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam