Create private endpoints for Azure CosmosDB for MongoDB

Question

Hi,

i want to configure my mongodb to only be available inside my virtual network. To do this i configured it as described here:

https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoints

Which works as expected. I have the mongodb available at myinstance.privatelink.mongo.cosmos.azure.com + myinstance.mongo.cosmos.azure.com and can talk to it in my network.

I now have the additional requirement to make changes to the throughput configuration for the mongodb database on the fly from my application inside an azure function. This works via the JS client as described here:

https://learn.microsoft.com/en-us/javascript/api/overview/azure/cosmos-readme?view=azure-node-latest

This talks to the endpoint:

https://your-account.documents.azure.com

After I moved the mongodb private, these calls do not work anymore and fail with:

Failed to migrate throughput to '{"throughputValue":30000,"throughputType":0}' for 'mydbname'! Request originated from VNET through service endpoint. This is blocked by your Cosmos DB account firewall settings.

How can I make these calls work? Which Endpoint should I talk to via the API?

Regards,

Sebastian

Answer 1

@SebMel Sorry for the delay in response to your question.

When you enable Private Endpoint, requests are supposed to come over the Private Endpoint, even if you have Service Endpoints enabled on the Subnet. I would need to check with the team why the requests are not coming over Private Endpoint.

In order to troubleshoot that we will need some information like the VM id (do not share this information publicly). Alternatively, you can try disabling Service Endpoints from the Subnets, and see if it resolves the problem.

If that does not resolve the issue. I would suggest sending an email to azcommunity@microsoft.com with the information requested above and do mention in the subject line ATTN: Oury so I don't miss it.

Please let me know.

Regards,

Oury

Answer 2

Hi @Oury Ba-MSFT

We do not have service endpoints for some vnets enabled for this cosmosdb, only the private endpoints. So as mentioned the mongodb based access works great but the access to https://your-account.documents.azure.com does not in our case.

What VM id are you referring to? The id of the cosmosdb instance?

Regards,

Sebastian