How to create Custom role in CosmosDB API for MongoDB with scope at Database level

Question

I have a requirement to create Custom roles with assignment scope at database level rather than at Account level in CosmosDB API for MongoDB. I could find documents related to same for SQL API - (https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac) . Is this simply not supported for MongoDB API? Would really appreciate if anyone can suggest on this or share document.

Answer 1

Hi @Vaikakkara, Anoop , welcome to Microsoft Q&A forum.

From what we understand you want to create custom role in Azure Cosmos DB Mongo API with scope at database level.

You can refer to below document that provides details on creating the custom role type for mongo DB API.

az cosmosdb mongodb role definition

az cosmosdb mongodb role definition create --account-name MyAccount --resource-group MyResourceGroup --body '{  
  "Id": "MyDB.My_Read_Only_Role",  
  "RoleName": "My_Read_Only_Role",  
  "Type": "CustomRole",  
  "DatabaseName": "MyDB",  
  "Privileges": [{  
    "Resource": {  
        "Db": "MyDB",  
        "Collection": "MyCol"  
      },  
      "Actions": [  
        "insert",  
        "find"  
      ]  
  }],  
  "Roles": [  
    {  
      "Role": "myInheritedRole",  
      "Db": "MyTestDb"  
    }  
  ]  
}'  

Please let us know if this helps or else we can discuss further.