Azure Bicep script to create role assignment in Azure Cosmos DB

Question

Hello,

We are creating Bicep script to provision of Azure Logic App. This logic app will connect to Azure Cosmos DB and create/update document data using upsert operation.

Logic app will create connection to Cosmos DB using Managed Identity connection option. System assigned managed identity will be used.

Logic app is created and system assigned identity is enabled using bicep script.

Cosmos DB "Cosmos DB Built-in Data Contributor" built in role will be used to allow upsert operation. https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#built-in-role-definitions

We are following below script for role assignment in cosmos db with below details:

resource symbolicname 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2021-10-15' = {
  name: 'string'
  parent: cosmosDB
  properties: {
    principalId: 'string'
    roleDefinitionId: 'string'
    scope: '/'
  }
}

Where principald is Logic app identity id.

We tried the below options to get the roleDefinitionId but it's failed:

1. Set roleDefinitionId as '/subscriptions/xxxx/resourceGroups/xxxx/providers/Microsoft.DocumentDB/databaseAccounts/xxxx/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002'
2. Used existing option to read roles:

resource symbolicname 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2023-04-15' existing= {

name: 'Cosmos DB Built-in Data Contributor'

}

1. Used existing option to read roles:

resource symbolicname 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2023-04-15' existing= {

name: '00000000-0000-0000-0000-000000000002'

}

Please guide or share the script to get the roleDefinitionId for built in "Cosmos DB Built-in Data Contributor" role

Answer 1

To assign the "Cosmos DB Built-in Data Contributor" role to a Logic App's system-assigned managed identity in Azure Cosmos DB using an Azure Bicep script, you can follow these steps:

1. Retrieve the roleDefinitionId for the "Cosmos DB Built-in Data Contributor" role. You can use the Azure CLI or Azure PowerShell to get the role definition ID.

Using Azure CLI:

Bash

az cosmosdb sql role definition list --account-name <cosmos-db-account-name> --resource-group <resource-group-name> --query "[?roleName=='Cosmos DB Built-in Data Contributor'].id | [0]"

Using Azure PowerShell:

(Get-AzRoleDefinition | Where-Object {$_.Name -eq "Cosmos DB Built-in Data Contributor"}).Id

1. Once you have the roleDefinitionId, you can use it in your Bicep script to create the role assignment:

Bicep

resource cosmosDBRoleAssignment 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2021-10-15' = {
  name: 'cosmosDBRoleAssignment'
  parent: cosmosDB
  properties: {
    principalId: '<logic-app-system-assigned-identity-object-id>'
    roleDefinitionId: '<role-definition-id>'
    scope: '/'
  }
}


Replace 
Make sure you have the necessary permissions to create role assignments in Azure Cosmos DB.