Open
Description
We should use the best practices from the Azure Cosmos DB for NoSQL security guide: https://learn.microsoft.com/azure/cosmos-db/nosql/security
This would require changing the projects to use RBAC and Entra authentication with the following code:
using Azure.Identity;
using Microsoft.Azure.Cosmos;
DefaultAzureCredential credential = new();
using CosmosClient client = new(
accountEndpoint: config?.CosmosUri,
tokenCredential: credential
);
and steps:
- Having the maintainers pre-import the
Azure.Identity
package:dotnet add package Azure.Identity --version 1.*
- Somehow setting up RBAC for user's accounts (no idea how you want to handle this)
- Instructing users to sign-in to Azure CLI or Visual Studio Code so the
DefaultAzureCredential
picks up their credential. - Instructing users to only add their endpoint to the environment (no keys) (ex:
dotnet user-secrets set "CosmosUri" "<nosql-account-endpoint>"
)
FYI @markjbrown