anishi1222

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "sku": {
      "value": "Consumption"
    },
    "publisherEmail": {
      "value": "email@example.com"
    },

anishi1222

{
  "@odata.context": "https://graph.microsoft.com/beta/$metadata#applications('<ObjectId for the application created in #1>')/federatedIdentityCredentials/$entity",
  "audiences": [
    "api://AzureADTokenExchange"
  ],
  "description": "<additional comments for federated identity credential>",
  ...,
  "issuer": "https://token.actions.githubusercontent.com",
  "name": "<name for federated identity credential>",
  "subject": "<GitHub username>/<repository>:refs/heads/<branch>"

anishi1222

{
  "canDelegate": null,
  ...,
  "principalId": "<Service Principal's Object ID created in #2>",
  "principalType": "ServicePrincipal",
  ...,
  "type": "Microsoft.Authorization/roleAssignments"
}

anishi1222

{
  "accountEnabled": "True",
  "addIns": [],
  "alternativeNames": [],
  "appDisplayName": "<Application Name created in #1>",
  "appId": "<appId for the Application created in #1>",
  "appOwnerTenantId": "<Azure AD tenant ID>",
  ...,
  "displayName": "<Application Name created in #1>",
  ...,

anishi1222

{
  "acceptMappedClaims": null,
  "addIns": [],
  "allowGuestsSignIn": null,
  "allowPassthroughUsers": null,
  "appId": "<Application ID>",
  ...,
  "displayName": "<Application Name specified via command>",
  ...,
  "objectId": "<Application's Object ID>",

anishi1222

CosmosClient client = new CosmosClientBuilder()
    .endpoint(ACCOUNT_ENDPOINT)
    .credential(tokenCredential)
    .gatewayMode()
    .buildClient();

anishi1222

resourceGroupName='<myResourceGroup>'
accountName='<myCosmosAccount>'
readOnlyRoleDefinitionId = '<roleDefinitionId of MyReadOnlyRole>'
ROprincipalId = '<Managed Identity Object ID for Function App, the app will be assigned to MyReadOnlyRole.>'
az cosmosdb sql role assignment create -a $accountName -g $resourceGroupName -s "/" -p $ROprincipalId -d $readOnlyRoleDefinitionId
 
readWriteRoleDefinitionId = '<roleDefinitionId of MyReadWriteRole>'
RWprincipalId = '<Managed Identity Object ID for Function App, the app will be assigned to MyReadWriteRole.>'
az cosmosdb sql role assignment create -a $accountName -g $resourceGroupName -s "/" -p $RWprincipalId -d $readWriteRoleDefinitionId

anishi1222

[
  {
    "assignableScopes": [
      "/subscriptions/{subscription id}/resourceGroups/{resource group}/providers/Microsoft.DocumentDB/databaseAccounts/{CosmosDB account}"
    ],
    "id": "/subscriptions/{subscription id}/resourceGroups/{resource group}/providers/Microsoft.DocumentDB/databaseAccounts/{CosmosDB account}/sqlRoleDefinitions/{roleDefinitionId}",
    "name": "{roleDefinitionId}",
    "permissions": [
      {
        "dataActions": [

anishi1222

az cosmosdb sql role definition list --account-name $accountName -g $resourceGroupName

anishi1222

resourceGroupName='<myResourceGroup>'
accountName='<myCosmosAccount>'
az cosmosdb sql role definition create -a $accountName -g $resourceGroupName -b @role-definition-ro.json
az cosmosdb sql role definition create -a $accountName -g $resourceGroupName -b @role-definition-rw.json