-
Notifications
You must be signed in to change notification settings - Fork 46
Open
Labels
Description
We should use the best practices from the Azure Cosmos DB for NoSQL security guide: https://learn.microsoft.com/azure/cosmos-db/nosql/security
This would require changing the projects to use RBAC and Entra authentication with the following code:
using Azure.Identity;
using Microsoft.Azure.Cosmos;
DefaultAzureCredential credential = new();
using CosmosClient client = new(
accountEndpoint: config?.CosmosUri,
tokenCredential: credential
);and steps:
- Having the maintainers pre-import the
Azure.Identitypackage:dotnet add package Azure.Identity --version 1.* - Somehow setting up RBAC for user's accounts (no idea how you want to handle this)
- Instructing users to sign-in to Azure CLI or Visual Studio Code so the
DefaultAzureCredentialpicks up their credential. - Instructing users to only add their endpoint to the environment (no keys) (ex:
dotnet user-secrets set "CosmosUri" "<nosql-account-endpoint>")
FYI @markjbrown