Allow to disable local auth on cosmosdb accounts #4054
Conversation
| @@ -9,6 +9,8 @@ param keyVaultName string | |||
| @allowed([ 'GlobalDocumentDB', 'MongoDB', 'Parse' ]) | |||
| param kind string | |||
|
|
|||
| param disableLocalAuth bool = false | |||
There was a problem hiding this comment.
Does cosmos/mongo now support MI? It didn't when we built this
There was a problem hiding this comment.
Yes, it's now supported (except for Mongo vCore currently, which isn't covered by this template anyways)
There was a problem hiding this comment.
Okay, I think in order to support this we'd need to update the templates to use MI instead of connection strings. Do you have a link to the doc that says Cosmos now supports MI for Mongo? I can't seem to find it.
There was a problem hiding this comment.
Digging a bit in the docs, it seems cosmos/mongo supports RBAC but not disabling local auth, as seen in the limitations section here: https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/how-to-setup-rbac#limitations
I've previously seen this docs https://learn.microsoft.com/en-us/azure/cosmos-db/role-based-access-control and assumed it was available for MongoDB (not vCore) too. I'll update the PR to only surface the parameter for NoSQL
There was a problem hiding this comment.
Thanks, but I don't think we'll take this change in infra/core since we are moving to AVM.
| @@ -9,6 +9,8 @@ param keyVaultName string | |||
| @allowed([ 'GlobalDocumentDB', 'MongoDB', 'Parse' ]) | |||
rajeshkamal5050
added
no-recent-activity
|
Hi @sinedied. Thank you for your contribution. Since there hasn't been recent engagement, we're going to close this out. Feel free to respond with a comment containing "/reopen" if you'd like to continue working on these changes. Please be sure to use the command to reopen or remove the "no-recent-activity" label; otherwise, this is likely to be closed again with the next cleanup pass. |
This PR allows to restrict CosmosDB account to use managed identity only.