Can we allow people to access only part of collections of a Cosmos DB?

Question

Can we allow people to access only part of collections of a Cosmos DB?

Zhuoling Li 1 Microsoft Employee

There is a Cosmos DB having multiple collections where we only care about some of them. Due to security concern, we only require a limited access to this Cosmos DB on collection level.

For example, the Cosmos DB has collection A, B and C but we only want to access A. Can we be allowed to access A while we are forbidden to access B and C? And how?

Zhuoling Li 1 Reputation point Microsoft Employee

2021-10-11T09:30:45.337+00:00

For collection, I mean 'container' here.

1 answer

Your answer

Zhuoling Li 1 Reputation point Microsoft Employee

2021-10-11T09:30:45.337+00:00

For collection, I mean 'container' here.

Answer 1

Oury Ba-MSFT 20,926 Microsoft Employee Moderator

Hi @Zhuoling Li Thank you for posting your question on Microsoft Q&A.
You can use cosmos DB resource tokens to restrict users access to Azure Cosmos DB resources.
Resource tokens are used for this purpose. User just need to create a permission to access just the container A, that should automatically forbid access to the other two containers.
There is an example in the following documentation. This section specifically shows how to create permission to access a specific container. For the specific container user can either grant full access or read only access. : Learn how to secure access to data in Azure Cosmos DB | Microsoft Learn

Hope that helps

Regards,
Oury

Zhuoling Li 1 Reputation point Microsoft Employee

2021-10-14T03:40:31.01+00:00
Hi @Oury Ba-MSFT Really thanks to your answer!

I was encountering another issue related to resource token. I wanted to connect to Cosmos DB through ADF in use of resource token but I only saw examples of using resource token within service. Do you have any idea how to use ADF to connect to Cosmos DB in use of any container-level access control?

There is some more background:

We are maintaining a data pipeline to ingest the data/entities from production micro-services' Cosmos DB that located worldwide to a single Global reporting Kusto via Azure Cosmos DB change feed. The pipeline looks like such Azure Cosmos DB feed change -> Event hub -> ASA-> Event hub -> Regional Kusto -> Global Kusto, we call it fast stream.

To ensure the quality of the reporting data, we also want to build a slow stream that sync data regularly to reporting Kusto from Cosmos DB to

Ensure the data consistency between Azure Cosmos DBs and Global Kusto

Back fill data if we have a new entity onboard to reporting Kusto

If we use ADF to sync data from Cosmos DB, we will have security concern as if ADF is compromised, all data will be exposed to the bad actor. In addition, I also want to know if we can leverage Azure Synapse or any other orchestration tool to achieve the goals of the slow stream.

Share via

Can we allow people to access only part of collections of a Cosmos DB?

1 answer

Your answer