Configuring Least Privilege Access in Azure Cosmos DB Using RBAC and Customer-Managed Keys

Question

When designing a secure Azure Cosmos DB deployment, it is important to limit permissions to only what each principal needs. How can I use Azure role-based access control (RBAC) to define fine‑grained permissions and combine that with customer‑managed keys for encryption‑at‑rest to achieve a least‑privilege configuration? Please outline the steps, any required Azure AD groups or role definitions, and how to verify that the settings are enforced.

Wasi · Answer

Create an Azure Key Vault (or use an existing one) and enable Soft Delete and Purge Protection.
Grant the Azure Cosmos DB service principal the Key permissions Get, Unwrap Key, and Wrap Key on the vault (either via an access policy or by assigning the built‑in Key Vault Crypto Service Encryption User role).
Generate a key in the vault and copy its Key Identifier (Key URI).
Create an Azure AD group (e.g., CosmosDB‑Admins) and add the users or service principals that need control‑plane access.
Assign the built‑in Cosmos DB Account Reader role or a custom role that grants Microsoft.DocumentDB/databaseAccounts/read and any required write actions to the group at the subscription/resource‑group level.
For data‑plane least privilege, create another Azure AD group (e.g., CosmosDB‑DataUsers) and assign a custom data‑plane role that includes only the needed actions such as Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/* for read/write, or more restrictive permissions as required.
When creating the Cosmos DB account, select Customer‑managed key, paste the Key URI, and optionally enable a system‑assigned or user‑assigned managed identity; the account will use the Key Vault permissions granted in step 2 to wrap/unwrap the CMK.
After deployment, verify:

In the Key Vault → Access control (IAM) confirm the Cosmos DB principal (or managed identity) has the Key Vault Crypto Service Encryption User role.
In the Cosmos DB account → Encryption shows the Key URI matches the vault key.
Using Azure CLI or PowerShell, run az role assignment list --assignee  to confirm the control‑plane and data‑plane role assignments.
Test a data operation with a user from the data‑plane group; it should succeed only for the permitted actions and fail for others.

Rollback (if needed):

Remove the role assignments from the Azure AD groups.
Re‑create the account with service‑managed keys (or disable CMK) by updating the keyVaultKeyUri to empty.
Delete the Key Vault key or revert the access policy to its previous state.

Configuring Least Privilege Access in Azure Cosmos DB Using RBAC and Customer-Managed Keys

1 answer

Your perspective belongs here.

1 question comment

Key Implementation Detail