Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow to disable local auth on cosmosdb accounts #4054

Closed
wants to merge 2 commits into from
Closed

Allow to disable local auth on cosmosdb accounts #4054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9da071e
Allow to disable local auth on cosmosdb accounts
sinedied Jul 1, 2024
77a3a44
Remove option to disable local auth for MongoDB
sinedied Jul 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions templates/common/infra/bicep/core/database/cosmos/cosmos-account.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ param keyVaultName string
@allowed([ 'GlobalDocumentDB', 'MongoDB', 'Parse' ])
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do all changes in AVM, not infra/core.

Here's the issue: #3327

Here's the PR: #3976

param kind string

param disableLocalAuth bool = false
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does cosmos/mongo now support MI? It didn't when we built this

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it's now supported (except for Mongo vCore currently, which isn't covered by this template anyways)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I think in order to support this we'd need to update the templates to use MI instead of connection strings. Do you have a link to the doc that says Cosmos now supports MI for Mongo? I can't seem to find it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Digging a bit in the docs, it seems cosmos/mongo supports RBAC but not disabling local auth, as seen in the limitations section here: https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/how-to-setup-rbac#limitations

I've previously seen this docs https://learn.microsoft.com/en-us/azure/cosmos-db/role-based-access-control and assumed it was available for MongoDB (not vCore) too. I'll update the PR to only surface the parameter for NoSQL

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, but I don't think we'll take this change in infra/core since we are moving to AVM.


resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' = {
name: name
kind: kind
Expand All @@ -29,6 +31,7 @@ resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' = {
apiProperties: (kind == 'MongoDB') ? { serverVersion: '4.2' } : {}
capabilities: [ { name: 'EnableServerless' } ]
minimalTlsVersion: 'Tls12'
disableLocalAuth: disableLocalAuth
}
}

Expand Down
2 changes: 2 additions & 0 deletions templates/common/infra/bicep/core/database/cosmos/sql/cosmos-sql-account.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ param location string = resourceGroup().location
param tags object = {}

param keyVaultName string
param disableLocalAuth bool = false

module cosmos '../../cosmos/cosmos-account.bicep' = {
name: 'cosmos-account'
Expand All @@ -13,6 +14,7 @@ module cosmos '../../cosmos/cosmos-account.bicep' = {
tags: tags
keyVaultName: keyVaultName
kind: 'GlobalDocumentDB'
disableLocalAuth: disableLocalAuth
}
}

Expand Down
2 changes: 2 additions & 0 deletions templates/common/infra/bicep/core/database/cosmos/sql/cosmos-sql-db.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ param tags object = {}
param containers array = []
param keyVaultName string
param principalIds array = []
param disableLocalAuth bool = false

module cosmos 'cosmos-sql-account.bicep' = {
name: 'cosmos-sql-account'
Expand All @@ -15,6 +16,7 @@ module cosmos 'cosmos-sql-account.bicep' = {
location: location
tags: tags
keyVaultName: keyVaultName
disableLocalAuth: disableLocalAuth
}
}

Expand Down