Azure RBAC permission to write Cosmos DB index policy but not create container

Question

Is it possible to create an Azure RBAC custom role that

has permission to write a Cosmos DB container's indexing policy
but is not allowed to create new containers?

It seems that the permission for writing the indexing policy is

Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/write

which is also sufficient for creating new containers (which is much more dangerous because it affects billing).

GeethaThatipatri-MSFT · Accepted Answer · 2024-03-22 18:22:28Z

1

No, this is not supported today. Note that there can be a billing impact from changing indexing policy as well, for example if the container throughput is provisioned as auto-scale and the indexing policy is modified in such a way that certain queries no longer run efficiently, thereby increasing the normalized RU utilization on the container and therefore the bill.

answered Mar 22, 2024 at 18:22

GeethaThatipatri-MSFT

3921 silver badge6 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Azure RBAC permission to write Cosmos DB index policy but not create container

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related