How to integrate RBAC in Azure functions

Question

Hi Team, We are working on bot framework project and using azure functions for triggering time trigger and cosmos db trigger. As part of RBAC access we have upgraded the web job commos db package and used the cosmos db endpoint and default azure credentials for creating cosmos client. Also configured the endpoint of tables in storage account. And upgraded the packages for web job extensions for storage and cosmos. But still we are getting the below error while building the Azure function. "Cannot create Collection Information for entity in database %CosmosDatabaseId% with lease leases in database %CosmosDatabaseId% : Format of the initialization string does not conform to specification starting at index 0. System.Data.Common: Format of the initialization string does not conform to specification starting at index 0." In Cosmos Db trigger we are directly providing the connection name which is the cosmos db connection string with endpoint. Is that the reason why we are getting the error. is there any other ways through which we can implement rbac in azure function for triggers We have already referred a document and get samples for Http trigger by creating cosmos client with endpoint and default azure credentials. But in our case we are passing along with connection name in cosmso db trigger

public async Task Run([CosmosDBTrigger(
            databaseName: "%CosmosDatabaseId%",
            containerName: "availableEmployes",
            Connection = "CosmosDbConnection", // taking the connection name provided in the josn file (https://<account_name>.table.core.windows.net/")
            LeaseContainerName = "leases",
            CreateLeaseContainerIfNotExists  = true)] IReadOnlyList<Item> input,
            ILogger logger,
            [Table("employeelogs", Connection = "AzureWebJobsStorage")] IAsyncCollector<EmployeeEntity> table,
            [CosmosDB(
            databaseName: "%CosmosDatabaseId%",
            containerName: "availableEmployes",
            Connection = "CosmosDbConnection")]CosmosClient client)

Answer 1

This is already supported; can you go through the sample below? https://learn.microsoft.com/en-us/azure/cosmos-db/managed-identity-based-authentication

Answer 2

Thanks for confirming, @lakshmi! I'll look into it and share my findings with you!
UPDATE:

It seems that the official doc covers the required config in detail. The CosmosDB trigger using managed identity would look as follows:

[Function("CosmosTrigger")]
public void Run([CosmosDBTrigger(
    databaseName: "ToDoItems",
    containerName:"TriggerItems",
    Connection = "CosmosDBConnection",
    LeaseContainerName = "leases",
    CreateLeaseContainerIfNotExists = true)] IReadOnlyList<ToDoItem> todoItems,
    FunctionContext context)
{
    if (todoItems is not null && todoItems.Any())
    {
        foreach (var doc in todoItems)
        {
            _logger.LogInformation("ToDoItem: {desc}", doc.Description);
        }
    }
}

Here, the Connection attribute points to the name of an app setting or setting collection that specifies how to connect to the Azure Cosmos DB account being monitored. This setting, which is the name of the app setting, will be in the following format: <CONNECTION_NAME_PREFIX>__accountEndpoint

The value for the setting will reference the Cosmos DB account endpoint URI, as shown in the doc: https://<database_account_name>.documents.azure.com:443/

So, if I had a CosmosDB account named contosodb, I would have the following:

In the local.settings.json file:

{
  "IsEncrypted": false,
  "Values": {
    "FUNCTIONS_WORKER_RUNTIME": "<language worker>",
    "AzureWebJobsStorage": "<connection-string>",
    "mycontosodb_accountEndpoint": "https://contosodb.documents.azure.com:443/"
  }
}

And in the trigger function:

[Function("CosmosTrigger")]
public void Run([CosmosDBTrigger(
    databaseName: "ToDoItems",
    containerName:"TriggerItems",
    Connection = "mycontosodb_accountEndpoint",
    LeaseContainerName = "leases",
    CreateLeaseContainerIfNotExists = true)] IReadOnlyList<ToDoItem> todoItems,
    FunctionContext context)
{
    if (todoItems is not null && todoItems.Any())
    {
        foreach (var doc in todoItems)
        {
            _logger.LogInformation("ToDoItem: {desc}", doc.Description);
        }
    }
}

That should be it as far as config on the functions side. However, you'll definitely want to give your Functions App the required RBAC permissions: Grant permission to the identity

Hope this helps!