Assign Entra ID user to CosmosDB PostgreSQL role using CLI/BICEP/Powershell

Question

Hi there,

We are using CosmosDB PostgreSQL Cluster and wish to use Entra ID authentication for all users. We build our environment completely via IaC using Bicep and CLI, but can't find how to create the roles for the Entra users.

https://learn.microsoft.com/en-us/azure/cosmos-db/postgresql/how-to-configure-authentication?tabs=portal#add-microsoft-entra-id-admins-to-azure-cosmos-db-for-postgresql-cluster

This document details how to create the user via the portal, but no mention of script options.

https://learn.microsoft.com/en-us/cli/azure/cosmosdb/postgres/role?view=azure-cli-latest#az-cosmosdb-postgres-role-create

The CLI command allows us to create a role, but doesn't show how to create an Entra ID role, just a native PostgreSQL user.

Is this possible? Has anyone successfully used scripting to create an Entra ID user within CosmosDB PostgreSQL cluster?

Cheers,

Ian

Answer 1

@Ian Clarke

I verified this internally and seems like we haven’t updated REST APIs after Entra ID support was added to Azure Cosmos DB for PostgreSQL. It means that REST APIs, CLI, Azure SDKs, Terraform don’t have Entra ID support.

 ARM templates and Bicep don’t depend on the published REST APIs update though. Customers can use it by referring to 2023-03-02-preview version. Customers would need to figure out desired properties and their values though as all of the updated functionality is usually documented in the REST APIs update. They can do it by downloading ARM templates on a cluster where Entra ID authentication is enabled and some Entra ID accounts are added.

 

 resource resourceName 'Microsoft.DBforPostgreSQL/serverGroupsv2@2023-03-02-preview' = {         name: clusterName        

location: location      

   tags: {}     

    properties: {        

                     ..                        

   }

Answer 2

Thanks for looking into this, it is appreciated.

Unfortunately the ARM template option doesn't help here as the console performs actions within Postgres itself (creates user).

~Thanks anyway