Keyless Connections to Azure Cosmos DB
summary
Demo shows migrating from key-based access to Azure Cosmos DB data-plane RBAC using Managed Identity and DefaultAzureCredential so apps never hold keys. Setup uses Azure CLI / PowerShell role assignment commands (granting principal id b47f) and built an ARM template that sets disableLocalAuth to true; the live demo returns the three items from the DB and then blocks key-based queries. Caveats: portal Data Explorer and the local emulator still require keys.
AI-written summary · about
chapters (6)
related talks
19mEnhancing Security in Azure Cosmos DB: Best Practices
51mSecuring Azure Cosmos DB
13mSecretless access to Azure SQL server using Managed Identity
51mService Principals and Managed Identities - the Identity tools every Azure developer should know
26mAzure Managed Identities: Why are you still using anything else?!?
42mService Principals and Managed Identities
55mOffensive Azure Security
01h 01mServerless & Schemaless with Azure Functions and CosmosDB