You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Learn how to secure access to data in Azure Cosmos DB
3
3
description: Learn about access control concepts in Azure Cosmos DB, including master keys, read-only keys, users, and permissions.
4
-
author: markjbrown
5
-
ms.author: mjbrown
4
+
author: thomasweiss
5
+
ms.author: thweiss
6
6
ms.service: cosmos-db
7
7
ms.topic: conceptual
8
-
ms.date: 05/21/2019
8
+
ms.date: 01/21/2020
9
9
10
10
---
11
11
# Secure access to data in Azure Cosmos DB
@@ -21,15 +21,16 @@ Azure Cosmos DB uses two types of keys to authenticate users and provide access
21
21
22
22
<aid="master-keys"></a>
23
23
24
-
## Master keys
24
+
## Master keys
25
+
26
+
Master keys provide access to all the administrative resources for the database account. Master keys:
25
27
26
-
Master keys provide access to all the administrative resources for the database account. Master keys:
27
28
- Provide access to accounts, databases, users, and permissions.
28
29
- Cannot be used to provide granular access to containers and documents.
29
30
- Are created during the creation of an account.
30
31
- Can be regenerated at any time.
31
32
32
-
Each account consists of two Master keys: a primary key and secondary key. The purpose of dual keys is so that you can regenerate, or roll keys, providing continuous access to your account and data.
33
+
Each account consists of two Master keys: a primary key and secondary key. The purpose of dual keys is so that you can regenerate, or roll keys, providing continuous access to your account and data.
33
34
34
35
In addition to the two master keys for the Cosmos DB account, there are two read-only keys. These read-only keys only allow read operations on the account. Read-only keys do not provide access to read permissions resources.
35
36
@@ -43,37 +44,29 @@ The process of rotating your master key is simple. Navigate to the Azure portal
43
44
44
45
### Code sample to use a master key
45
46
46
-
The following code sample illustrates how to use a Cosmos DB account endpoint and master key to instantiate a DocumentClient and create a database.
47
+
The following code sample illustrates how to use a Cosmos DB account endpoint and master key to instantiate a DocumentClient and create a database.
47
48
48
49
```csharp
49
50
//Read the Azure Cosmos DB endpointUrl and authorization keys from config.
50
51
//These values are available from the Azure portal on the Azure Cosmos DB account blade under "Keys".
51
-
//NB > Keep these values in a safe and secure location. Together they provide Administrative access to your DocDB account.
52
+
//Keep these values in a safe and secure location. Together they provide Administrative access to your Azure Cosmos DB account.
Resource tokens provide access to the application resources within a database. Resource tokens:
63
+
71
64
- Provide access to specific containers, partition keys, documents, attachments, stored procedures, triggers, and UDFs.
72
65
- Are created when a [user](#users) is granted [permissions](#permissions) to a specific resource.
73
66
- Are recreated when a permission resource is acted upon on by POST, GET, or PUT call.
74
67
- Use a hash resource token specifically constructed for the user, resource, and permission.
75
-
- Are time bound with a customizable validity period. The default valid timespan is one hour. Token lifetime, however, may be explicitly specified, up to a maximum of five hours.
76
-
- Provide a safe alternative to giving out the master key.
68
+
- Are time bound with a customizable validity period. The default valid time span is one hour. Token lifetime, however, may be explicitly specified, up to a maximum of five hours.
69
+
- Provide a safe alternative to giving out the master key.
77
70
- Enable clients to read, write, and delete resources in the Cosmos DB account according to the permissions they've been granted.
78
71
79
72
You can use a resource token (by creating Cosmos DB users and permissions) when you want to provide access to resources in your Cosmos DB account to a client that cannot be trusted with the master key.
@@ -82,90 +75,69 @@ Cosmos DB resource tokens provide a safe alternative that enables clients to rea
82
75
83
76
Here is a typical design pattern whereby resource tokens may be requested, generated, and delivered to clients:
84
77
85
-
1. A mid-tier service is set up to serve a mobile application to share user photos.
78
+
1. A mid-tier service is set up to serve a mobile application to share user photos.
86
79
2. The mid-tier service possesses the master key of the Cosmos DB account.
87
-
3. The photo app is installed on end-user mobile devices.
80
+
3. The photo app is installed on end-user mobile devices.
88
81
4. On login, the photo app establishes the identity of the user with the mid-tier service. This mechanism of identity establishment is purely up to the application.
89
82
5. Once the identity is established, the mid-tier service requests permissions based on the identity.
90
83
6. The mid-tier service sends a resource token back to the phone app.
91
-
7. The phone app can continue to use the resource token to directly access Cosmos DB resources with the permissions defined by the resource token and for the interval allowed by the resource token.
84
+
7. The phone app can continue to use the resource token to directly access Cosmos DB resources with the permissions defined by the resource token and for the interval allowed by the resource token.
92
85
8. When the resource token expires, subsequent requests receive a 401 unauthorized exception. At this point, the phone app re-establishes the identity and requests a new resource token.
93
86
94
87
95
88
96
-
Resource token generation and management is handled by the native Cosmos DB client libraries; however, if you use REST you must construct the request/authentication headers. For more information on creating authentication headers for REST, see [Access Control on Cosmos DB Resources](https://docs.microsoft.com/rest/api/cosmos-db/access-control-on-cosmosdb-resources) or the [source code for our SDKs](https://github.com/Azure/azure-documentdb-node/blob/master/source/lib/auth.js).
89
+
Resource token generation and management is handled by the native Cosmos DB client libraries; however, if you use REST you must construct the request/authentication headers. For more information on creating authentication headers for REST, see [Access Control on Cosmos DB Resources](https://docs.microsoft.com/rest/api/cosmos-db/access-control-on-cosmosdb-resources) or the source code for our [.NET SDK](https://github.com/Azure/azure-cosmos-dotnet-v3/blob/master/Microsoft.Azure.Cosmos/src/AuthorizationHelper.cs) or [Node.js SDK](https://github.com/Azure/azure-cosmos-js/blob/master/src/auth.ts).
97
90
98
91
For an example of a middle tier service used to generate or broker resource tokens, see the [ResourceTokenBroker app](https://github.com/Azure/azure-documentdb-dotnet/tree/master/samples/xamarin/UserItems/ResourceTokenBroker/ResourceTokenBroker/Controllers).
99
92
100
-
<aid="users"></a>
93
+
## Users<aid="users"></a>
101
94
102
-
## Users
103
-
Cosmos DB users are associated with a Cosmos database. Each database can contain zero or more Cosmos DB users. The following code sample shows how to create a Cosmos DB user resource.
95
+
Azure Cosmos DB users are associated with a Cosmos database. Each database can contain zero or more Cosmos DB users. The following code sample shows how to create a Cosmos DB user using the [Azure Cosmos DB .NET SDK v3](https://github.com/Azure/azure-cosmos-dotnet-v3/tree/master/Microsoft.Azure.Cosmos.Samples/Usage/UserManagement).
> Each Cosmos DB user has a PermissionsLink property that can be used to retrieve the list of [permissions](#permissions) associated with the user.
117
-
>
118
-
>
105
+
> Each Cosmos DB user has a ReadAsync() method that can be used to retrieve the list of [permissions](#permissions) associated with the user.
119
106
120
-
<aid="permissions"></a>
107
+
## Permissions<aid="permissions"></a>
121
108
122
-
## Permissions
123
-
A Cosmos DB permission resource is associated with a Cosmos DB user. Each user may contain zero or more Cosmos DB permissions. A permission resource provides access to a security token that the user needs when trying to access a specific application resource.
124
-
There are two available access levels that may be provided by a permission resource:
109
+
A permission resource is associated with a user and assigned at the container as well as partition key level. Each user may contain zero or more permissions. A permission resource provides access to a security token that the user needs when trying to access a specific container or data in a specific partition key. There are two available access levels that may be provided by a permission resource:
125
110
126
-
* All: The user has full permission on the resource.
127
-
* Read: The user can only read the contents of the resource but cannot perform write, update, or delete operations on the resource.
111
+
- All: The user has full permission on the resource.
112
+
- Read: The user can only read the contents of the resource but cannot perform write, update, or delete operations on the resource.
128
113
129
114
> [!NOTE]
130
-
> In order to run Cosmos DB stored procedures the user must have the All permission on the container in which the stored procedure will be run.
131
-
>
132
-
>
115
+
> In order to run stored procedures the user must have the All permission on the container in which the stored procedure will be run.
133
116
134
117
### Code sample to create permission
135
118
136
119
The following code sample shows how to create a permission resource, read the resource token of the permission resource, and associate the permissions with the [user](#users) created above.
If you have specified a partition key for your collection, then the permission for collection, document, and attachment resources must also include the ResourcePartitionKey in addition to the ResourceLink.
132
+
### Code sample to read permission for user
152
133
153
-
### Code sample to read permissions for user
154
-
155
-
To easily obtain all permission resources associated with a particular user, Cosmos DB makes available a permission feed for each user object. The following code snippet shows how to retrieve the permission associated with the user created above, construct a permission list, and instantiate a new DocumentClient on behalf of the user.
134
+
The following code snippet shows how to retrieve the permission associated with the user created above and instantiate a new CosmosClient on behalf of the user, scoped to a single partition key.
@@ -183,11 +155,14 @@ To add Azure Cosmos DB account reader access to your user account, have a subscr
183
155
The entity can now read Azure Cosmos DB resources.
184
156
185
157
## Delete or export user data
158
+
186
159
Azure Cosmos DB enables you to search, select, modify and delete any personal data located in database or collections. Azure Cosmos DB provides APIs to find and delete personal data however, it’s your responsibility to use the APIs and define logic required to erase the personal data.
187
160
Each multi-model API (SQL, MongoDB, Gremlin, Cassandra, Table) provides different language SDKs that contain methods to search and delete personal data. You can also enable the [time to live (TTL)](time-to-live.md) feature to delete data automatically after a specified period, without incurring any additional cost.
* To learn more about Cosmos database security, see [Cosmos DB: Database security](database-security.md).
193
-
* To learn how to construct Azure Cosmos DB authorization tokens, see [Access Control on Azure Cosmos DB Resources](https://docs.microsoft.com/rest/api/cosmos-db/access-control-on-cosmosdb-resources).
165
+
166
+
- To learn more about Cosmos database security, see [Cosmos DB Database security](database-security.md).
167
+
- To learn how to construct Azure Cosmos DB authorization tokens, see [Access Control on Azure Cosmos DB Resources](https://docs.microsoft.com/rest/api/cosmos-db/access-control-on-cosmosdb-resources).
168
+
- User management samples with users and permissions, [.NET SDK v3 user management samples](https://github.com/Azure/azure-cosmos-dotnet-v3/blob/master/Microsoft.Azure.Cosmos.Samples/Usage/UserManagement/UserManagementProgram.cs)
Copy file name to clipboardExpand all lines: articles/dms/tutorial-oracle-azure-postgresql-online.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.service: dms
11
11
ms.workload: data-services
12
12
ms.custom: "seo-lt-2019"
13
13
ms.topic: article
14
-
ms.date: 01/08/2020
14
+
ms.date: 01/24/2020
15
15
---
16
16
17
17
# Tutorial: Migrate Oracle to Azure Database for PostgreSQL online using DMS (Preview)
@@ -44,7 +44,7 @@ To complete this tutorial, you need to:
44
44
45
45
* Download and install [Oracle 11g Release 2 (Standard Edition, Standard Edition One, or Enterprise Edition)](https://www.oracle.com/technetwork/database/enterprise-edition/downloads/index.html).
46
46
* Download the sample **HR** database from [here](https://docs.oracle.com/database/121/COMSC/installation.htm#COMSC00002).
47
-
* Download and install ora2pg on either [Windows](https://github.com/Microsoft/DataMigrationTeam/blob/master/Whitepapers/Steps%20to%20Install%20ora2pg%20on%20Windows.pdf) or [Linux](https://github.com/Microsoft/DataMigrationTeam/blob/master/Whitepapers/Steps%20to%20Install%20ora2pg%20on%20Linux.pdf).
47
+
* Download and [install ora2pg on either Windows or Linux](https://github.com/microsoft/DataMigrationTeam/blob/master/Whitepapers/Steps%20to%20Install%20ora2pg%20on%20Windows%20and%20Linux.pdf).
48
48
*[Create an instance in Azure Database for PostgreSQL](https://docs.microsoft.com/azure/postgresql/quickstart-create-server-database-portal).
49
49
* Connect to the instance and create a database using the instruction in this [document](https://docs.microsoft.com/azure/postgresql/tutorial-design-database-using-azure-portal).
50
50
* Create a Microsoft Azure Virtual Network for Azure Database Migration Service by using the Azure Resource Manager deployment model, which provides site-to-site connectivity to your on-premises source servers by using either [ExpressRoute](https://docs.microsoft.com/azure/expressroute/expressroute-introduction) or [VPN](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways). For more information about creating a virtual network, see the [Virtual Network Documentation](https://docs.microsoft.com/azure/virtual-network/), and especially the quickstart articles with step-by-step details.
@@ -193,7 +193,7 @@ To configure and run ora2pg for schema conversion, see the **Migration: Schema a
193
193
194
194
You can choose to convert Oracle table schemas, stored procedures, packages, and other database objects to make them Postgres compatible by using ora2pg before starting a migration pipeline in Azure Database Migration Service. See the links below for how to work with ora2pg:
195
195
196
-
* [Install ora2pg on Windows](https://github.com/Microsoft/DataMigrationTeam/blob/master/Whitepapers/Steps%20to%20Install%20ora2pg%20on%20Windows.pdf)
196
+
* [Install ora2pg on Windows](https://github.com/microsoft/DataMigrationTeam/blob/master/Whitepapers/Steps%20to%20Install%20ora2pg%20on%20Windows%20and%20Linux.pdf)
197
197
* [Oracle to Azure PostgreSQL Migration Cookbook](https://github.com/Microsoft/DataMigrationTeam/blob/master/Whitepapers/Oracle%20to%20Azure%20PostgreSQL%20Migration%20Cookbook.pdf)
198
198
199
199
Azure Database Migration Service can also create the PostgreSQL table schema. The service accesses the table schema in the connected Oracle source and creates a compatible table schema in Azure Database for PostgreSQL. Be sure to validate and check the schema format in Azure Database for PostgreSQL after Azure Database Migration Service finishes creating the schema and moving the data.
0 commit comments