How to grant access to a user for a specific container instead at db level (IAM)

Avula, Mallikarjuna 1

We have shared environment, i.e., maintaining multiple cosmosdb databases and containers in same cosmos account, I would like to know how to grant access to a user to a specific cosmosdb or container using UI.

1 answer

KalyanChanumolu-MSFT 8,341 Reputation points

2021-01-08T06:35:32.627+00:00

@Avula, Mallikarjuna Welcome to Microsoft Q&A and thank you for your interest in Azure Cosmos DB.

It is currently not possible to grant users access to specific containers.
The built in roles are used to secure access at a Cosmos DB account level.
Please sign in to rate this answer.
Avula, Mallikarjuna 1 Reputation point

2021-01-08T07:05:52.45+00:00

I have found couple of articles in GITHUB link that shows how to grant access to container level. More over we are not complete documentation while support it and every time we need to chase for administration activities. Not sure how Microsoft is missed a such a mandatory tasks while develop a product.

https://github.com/PlagueHO/CosmosDB/wiki#working-with-users

For example :
Create a user in the database:

New-CosmosDbUser -Context $cosmosDbContext -Id 'dscottraynsford@Company portal .com'

Create a permission for a user in the database with read access to a collection:

$collectionId = Get-CosmosDbCollectionResourcePath -Database 'MyDatabase' -Id 'MyNewCollection'
New-CosmosDbPermission -Context $cosmosDbContext -UserId 'dscottraynsford@Company portal .com' -Id 'r_mynewcollection' -Resource $collectionId -PermissionMode Read

KalyanChanumolu-MSFT 8,341 Reputation points

2021-02-01T10:02:42.557+00:00

@Avula, Mallikarjuna As suggested in the article, the approach uses ResourceTokens to manage user permissions.
The users created by running the powershell command New-CosmosDbUser are local to the database and not the same as Active Directory domain accounts.

So you cannot manage permissions on Containers using IAM. You can do so using ResourceTokens

----------

If an answer is helpful, please "Accept answer" or "Up-Vote" for the same which might be beneficial to other community members reading this thread.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to grant access to a user for a specific container instead at db level (IAM)

1 answer

Your answer