Connecting Azure stream analytics job output to Azure Cosmos db with private end point

Satyam Chauhan 492

Hi,

In order to secure the cosmos DB we have enabled private access with Private end point. For this we created a private end-point with resource type Microsoft.AzureCosmosDB/databaseAccounts and Private DNS Zone privatelink.documents.azure.com for cosmos DB account.

We have also created an azure stream analytics job which is streaming data output to the cosmos DB, but after configuring the private access we are not able to stream that data.

Please provide a solution for streaming data securely to cosmos DB.

AnnuKumari-MSFT 30,676 Reputation points Microsoft Employee

2023-01-09T09:32:43.04+00:00

Hi @Satyam Chauhan ,
Just checking in to see if the above answer helped. Please do consider clicking Accept Answer and Up-Vote for the same as accepted answers help community as well. If you have any further query do let us know.

1 answer

ShaikMaheer-MSFT 37,896 Reputation points Microsoft Employee

2023-01-02T07:27:52.757+00:00

Hi @Satyam Chauhan ,

Thank you for posting query in Microsoft Q&A Platform.

You need to consider creating managed end point for your cosmosdb resource in your stream analytics cluster. Then approve the private end point connection from your input or output.

Once approve the connection, jobs running can access the cosmosdb resource through private endpoint.

Kindly check below official documentation which explains same with details steps.
https://learn.microsoft.com/en-us/azure/stream-analytics/private-endpoints

Hope this helps. Please let me know if any further queries.

Please consider hitting Accept Answer button. Accepted answers help community as well.
Please sign in to rate this answer.
Satyam Chauhan 492 Reputation points

2023-01-02T09:01:30.867+00:00

Hi @ShaikMaheer-MSFT ,
Thank you for answering,

I see the solution is for stream analytics cluster, but in my case we are using stream analytics job, so is there a way of doing the same in stream analytics job?

Bas Pruijn 946 Reputation points

2023-01-02T10:41:07.533+00:00

According to the documentation (https://azure.microsoft.com/en-us/pricing/details/stream-analytics/#purchase-options), VNET support is not available for Stream Analytics jobs; only for clusters. If your cluster is running at least 36SU, pricing would be identical. If you require lower SU levels, this might lead to a (very) steep increase in costs.

This is another example of Microsoft mixing up security (VNET in this case) and capacity, where you can only use the security features if you use the high capacity solution (with accompanying high pricing).

Satyam Chauhan 492 Reputation points

2023-01-30T06:46:43.1066667+00:00

Hi @Bas Pruijn ,

I had one more question regarding this.

When I tried with Stream Analytics Cluster then it was working without any issue. But when I try with Stream Analytics Jobs it says "Permissions for 'rawtagoutput' still propagating, try again in a little while." Here rawtagoutput is the alias for cosmos Db output in stream analytics jobs.

So do we need to give any extra permission for this to work?

Bas Pruijn 946 Reputation points

2023-02-07T08:38:11.5333333+00:00

Sorry for the delayed response. As far as I know it will NOT be possible to use a private endpoint together with a stream analytics job.
Sign in to comment