RBAC permission issue while accessing cosmos db using managed identity

Question

I want to read/write data in Cosmos DB from azure function, added code in azure functions(c#) to access cosmos db using managed identity ,role for azure function in Cosmos db is Document db Account Contributor & Cosmos DB Account Reader role & As per the microsoft document ,readmetadata is included in Data Contributor role but still getting below error :

Response status code does not indicate success: Forbidden (403); Substatus: 5301; ActivityId:<>; Reason: (Request blocked by Auth

Answer 1

Hi Siddharth,

Please confirm that you have assigned Cosmos DB Built-in Data contributor to the managed identity using New-AzCosmosDBSqlRoleAssignment or az cosmosdb sql role assignment create . For example, you would use command similar to below :

New-AzCosmosDBSqlRoleAssignment -AccountName my-cosmosdb -ResourceGroupName cosmos-rg -RoleDefinitionId 00000000-0000-0000-0000-000000000002 -Scope "/" -PrincipalId "<object (principal) ID of managed identity>"

For reference, please see articles below:

Configure role-based access control with Azure Active Directory for your Azure Cosmos DB account

https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac

https://learn.microsoft.com/en-us/powershell/module/az.cosmosdb/new-azcosmosdbsqlroleassignment

Thanks.

-TP

Answer 2

Hi @siddharth bansal

The readMetadata is not included on those roles. This document actually walks you through creating a custom role for that permission and assigning it to your managed identity.

Create a role definition JSON file to create and the definition and role; then assign this role to your managed identity.

{
    "RoleName": "Read Azure Cosmos DB Metadata",
    "Type": "CustomRole",
    "AssignableScopes": ["/"],
    "Permissions": [{
        "DataActions": [
            "Microsoft.DocumentDB/databaseAccounts/readMetadata"
        ]
    }]
}

az cosmosdb sql role definition create --resource-group $resourceGroupName --account-name $cosmosName --body @definition.json

az cosmosdb sql role assignment create --resource-group $resourceGroupName --account-name $cosmosName --role-definition-name "Read Azure Cosmos DB Metadata" --principal-id $principal --scope $scope