We have discussed "Add Cosmos DB Built-in Roles to Resource Identities via Terraform to Allow Role Based Access to Data in Cosmos DB" in the previous post. Now that the data constributor roles are setup in Azure Cosmos DB, let's look at how to write a simple code to access, create Cosmos DB data using DefaultAzureCredential with C#.
The expection is to get document data created in Cosmos DB as similar to shown below.
Azure Cosmos DB can be used with DefaultAzureCrentials in C#. However, for enabling usage of DefaultAzureCrentials with Azure Cosmos DB requires special data roles to be added to the Cosmos DB account. There are two built in roles data reader and data contributor. Unlike other RBAC roles in Azure these roles cannot be assigned via Azure portal and they must be added programatically. They have to added via Azure CLI, Bicep, Powershell, REST API or Terraform.
We have discussed the setting up of user assigned identity and using it in app services in the post "User Assigned Managed identity for Azure App Services with Bicep". We can use such user assigned identity service principal Id and assign it in role based access management in other resources such as app config service to enable app service to read application configurations from the app config service.
