Keyless Connections to Azure Cosmos DB (RBAC auth for data)
summary
Shows how to stop using Cosmos DB keys by switching to RBAC and Managed Identity, using the SDK overload that accepts DefaultAzureCredential and granting app principals via Azure CLI or PowerShell role assignments (role 0001 = read, 0002 = read/write). Sets the resource property disableLocalAuth to true so keys become unusable, removes key rotation and Key Vault management, and requires the Cosmos DB Data Explorer (portal Data Explorer and the local emulator still require the key). Demonstrates with a sample function app reading three items and failing until RBAC is granted.
AI-written summary · about
chapters (6)
related talks
51mSecuring Azure Cosmos DB
19mEnhancing Security in Azure Cosmos DB: Best Practices
13mSecretless access to Azure SQL server using Managed Identity
48mSecuring Cosmos DB: Ready for Production!
51mService Principals and Managed Identities - the Identity tools every Azure developer should know
01h 00mEverything You Always Wanted to Know About Azure Security But Were Afraid to Ask
45mA to Z Azure SQL Security Concepts
55mOffensive Azure Security