Azure Cosmos Postgresql issue with Role creation

Vipal Mehta 20

Hi,

We are using Azure Cosmos Postgresql DB and we are experiencing issues with Role creation. We created a role from console as well as az cli using below command -

The command shows succeeded and the role is visible. However the same role is not visible on the Database where we logged in using psql as well as with PgAdmin tool.

It says Role does not exist, however the Azure portal displays the role as well as Azure cli command says success. Kindly advise if there are any issues with Role syncing from the portal/cli to the actual node. If so, how much time the role takes to reflect after succeeding.

User's image

az cosmosdb postgres role create -n "testrole" --password "password" --cluster-name "test-cluster" -g "testGroup" --subscription "ffffffff-ffff-ffff-ffff-ffffffffffff"

Oury Ba-MSFT 19,346 Reputation points Microsoft Employee

2024-08-23T20:42:50.13+00:00

@Vipal Mehta Thank you for reaching out and apologies for the issue you are facing with user creation on Azure Cosmos DB for PostgreSQL.

All management operations related to roles are supported by Azure Cosmos DB for PostgreSQL. I would suggest opening an Azure support request, so that our support engineers can debug it with you.

Regards,

Oury
Oury Ba-MSFT 19,346 Reputation points Microsoft Employee

2024-08-27T16:33:13.89+00:00

@Vipal Mehta Were you able to create a support ticket. If yes, could you please share the support ticket number.
Vipal Mehta 20 Reputation points

2024-08-27T17:42:45.6866667+00:00

@Oury Ba-MSFT
Apologies, but opening a support ticket requires technical support, which my account does not have.
Could you help me to create one ticket for this?
We are using Cosmos Postgresql on all our development environments, but encountering issues with role creation and delay with the functionality comes as a challenge which is out of our scope.

Thanks!
Oury Ba-MSFT 19,346 Reputation points Microsoft Employee

2024-09-18T22:44:14.9133333+00:00

@Vipal Mehta

Could you please share the support ticket to track internally?

Once the issue has been resolved with the help of support, please do share the resolution, which might be beneficial to other community members reading this thread.
Vipal Mehta 20 Reputation points

2024-09-19T03:22:21.4066667+00:00

@Oury Ba-MSFT
Kindly check the email, I still don't have access to create support ticket for the issue.

1 answer

Sina Salam 11,206 Reputation points

2024-08-23T11:59:40.03+00:00

Hello Vipal Mehta,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having issues with role creation in Azure Cosmos DB for PostgreSQL.

Hope you are not performing actions that might conflict with the role creation, such as creating or deleting child resources (databases, containers, etc.) before the role synchronization completes. Ensure the creation of the role completed and synchronized, also, check via the Azure portal, the Azure CLI and Database to confirm the role exist. Then, check out these links for more detailed steps about role creation: https://learn.microsoft.com/en-us/azure/cosmos-db/role-based-access-control and https://github.com/MicrosoftDocs/azure-docs/issues/114839.

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam
Please sign in to rate this answer.
Vipal Mehta 20 Reputation points

2024-08-23T12:12:33.55+00:00

Hello @Sina Salam
Thanks for the response!

The screenshots I have provided, has a step where I created a role and that was visible on the portal as well as on Azure cli.
However, the same was not visible or synced to the coordinator node of the DB, where the actual DB runs and the roles should have been synced/displayed.

On below query -

Hope you are not performing actions that might conflict with the role creation, such as creating or deleting child resources (databases, containers, etc.) before the role synchronization completes.

No, the role gets created successfully, and I have not performed any updates to the DB. The task was only to create role and assign it certain read permissions. But the role was not displayed in the psql cli or the DB, to grant privileges to that Role.

This Role is not the RBAC role, this role is DB role that we create from the Azure Cosmos portal. Also how we can check if the role has been synchronized to the node? Do we have any command on azure cli or portal to validate the same?

Thanks,

Vipal Mehta

Sina Salam 11,206 Reputation points

2024-08-23T16:42:17.85+00:00

Hello @Vipal Mehta

Thank you for your feedback.

I understood your perspectives and the technology involves: So sorry for all the inconveniences. However, role management in Cosmos DB is typically handled at a higher level and may not sync immediately to lower-level database nodes. So, it's unfortunately that Azure Cosmos DB doesn’t provide direct CLI commands to check the synchronization status of roles to database nodes.

Sometimes, changes might take a few moments to reflect. Ensure that you refresh the Azure Cosmos DB portal to check if the role appears.

Give it some time and retry checking the database roles later.

For Azure Cosmos DB specifically, you can verify roles and permissions in the portal where roles are created. However, for detailed insights into synchronization, might not be directly possible. Likewise, Azure CLI does not provide direct commands to manage or check synchronization status of database role, except via Azure SDKs if you're using (.NET or Python) to interact with Cosmos DB in more advanced programmatic checks.

So, try to run queries database via psql CLI to list roles and permissions to see if they eventually appear: \du -- This lists roles in PostgreSQL

So far it shows on the portal it will synchronize it might take longer than expected.

cheers
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Cosmos Postgresql issue with Role creation

1 answer

Your answer