Setting Up Granular Security for Cosmos DB SQL Containers

Question

Pulumi · Accepted Answer

Setting up granular security for Cosmos DB SQL Containers is essential for ensuring your database has specific permissions and roles configured to control access at a fine-grained level. In Pulumi, you can set up security for Azure Cosmos DB SQL containers by creating role definitions and role assignments, specifying the permissions necessary for the roles, and assigning those roles to principals (like users or managed identities) within Azure.

We will be utilizing two key Pulumi resources for this task:

1. `SqlRoleDefinition`: This resource creates a role definition with specific data actions that outline what a principal can do within your Cosmos DB account.
   
2. `SqlRoleAssignment`: This resource assigns the defined role to a principal for a specific scope within your Cosmos DB account.

Here's a Python program using Pulumi to create a custom role definition and assign it to a principal for controlling access to an Azure Cosmos DB SQL container:

```python
import pulumi
import pulumi_azure_native as azure_native

# Set your Cosmos DB account, database, and container names
account_name = 'cosmos-db-account'
database_name = 'database-name'
container_name = 'container-name'
resource_group_name = 'resource-group-name'
principal_id = 'principal-guid'  # Replace with the actual principal ID

# Create a custom role definition for read-only access to a specific container
read_only_role_definition = azure_native.documentdb.SqlResourceSqlRoleDefinition(
    'read-only-role',
    account_name=account_name,
    resource_group_name=resource_group_name,
    role_definition_id='unique-guid',  # Replace with a unique GUID
    resource={
        'permissions': [
            # Add permissions as needed
            {
                'data_actions': [
                    'Microsoft.DocumentDB/databaseAccounts/readMetadata',
                    'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read',
                    # More data actions can be added based on the access required
                ],
            },
        ],
        'assignable_scopes': [
            f'/subscriptions/{pulumi.config.require("subscription_id")}/resourceGroups/{resource_group_name}/providers/Microsoft.DocumentDB/accountName/{account_name}'
        ],
        'type': 'Custom'
    }
)

# Assign the read-only role to the principal for the specific container scope
read_only_role_assignment = azure_native.documentdb.SqlResourceSqlRoleAssignment(
    'read-only-role-assignment',
    account_name=account_name,
    resource_group_name=resource_group_name,
    role_assignment_id='unique-guid',  # Replace with a unique GUID
    scope=f'/subscriptions/{pulumi.config.require("subscription_id")}/resourceGroups/{resource_group_name}/providers/Microsoft.DocumentDB/accountName/{account_name}/sqlRoleDefinitions/{read_only_role_definition.role_definition_id}',  # Use the role definition's resulting ID
    resource={
        'principal_id': principal_id,
    }
)

pulumi.export('roleDefinitionId', read_only_role_definition.role_definition_id)
pulumi.export('roleAssignmentId', read_only_role_assignment.role_assignment_id)
```

Before executing this program, ensure you replace the placeholder values (`'cosmos-db-account'`, `'database-name'`, `'container-name'`, `'resource-group-name'`, `'principal-guid'`, and `'unique-guid'`) with actual values that correspond to your Azure environment.

In this program, we've created a custom role definition called `read-only-role` which grants read access to items within a given Cosmos DB container. This role is then assigned to a principal through the `read-only-role-assignment` resource.

Importantly, the scope of the role definition and the role assignment includes the subscription ID, resource group name, and Cosmos DB account name, which you need to set appropriately.

The `pulumi.export` statements at the end of the script output the IDs for the role definition and the role assignment, which can be used for referencing these resources later.

Please ensure you have the Azure Pulumi provider configured and authenticated to run this code. Once you run `pulumi up` with this program, Pulumi will provision the resources as described in the program.