Skip to content

Commit 3cede4a

Browse files
LJSpillerLJSpiller
authored
Merge pull request #197113 from enkrumah/cosmosdbdoc
created docs for managed identities for CosmosDB and ServiceBus
2 parents d0c2652 + cb807ff commit 3cede4a

File tree

3 files changed

+170
-0
lines changed

3 files changed

+170
-0
lines changed

‎articles/stream-analytics/TOC.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,9 @@
212212
- name: Blob storage
213213
href: blob-output-managed-identity.md
214214
displayName: managed identity, identities, authenticate
215+
- name: Cosmos DB
216+
href: cosmos-db-managed-identity.md
217+
displayName: managed identity, identities, authenticate
215218
- name: Event Hubs
216219
href: event-hubs-managed-identity.md
217220
displayName: managed identity, identities, authenticate
@@ -221,6 +224,9 @@
221224
- name: Azure SQL & Azure Synapse
222225
href: sql-database-output-managed-identity.md
223226
displayName: managed identity, identities, authenticate
227+
- name: Service Bus
228+
href: service-bus-managed-identity.md
229+
displayName: managed identity, identities, authenticate
224230
- name: Build solutions
225231
items:
226232
- name: Twitter sentiment analysis

‎articles/stream-analytics/cosmos-db-managed-identity.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
title: Use managed identities to access Cosmos DB from an Azure Stream Analytics job
3+
description: This article describes how to use managed identities to authenticate your Azure Stream Analytics job to an Azure CosmosDB output.
4+
author: enkrumah
5+
ms.author: ebnkruma
6+
ms.service: stream-analytics
7+
ms.topic: how-to
8+
ms.date: 05/04/2022
9+
ms.custom: subject-rbac-steps
10+
---
11+
12+
# Use managed identities to access Cosmos DB from an Azure Stream Analytics job (preview)
13+
14+
Azure Stream Analytics supports managed identity authentication for Azure Cosmos DB output. Managed identities eliminate the limitations of user-based authentication methods, like the need to reauthenticate because of password changes or user token expirations that occur every 90 days. When you remove the need to manually authenticate, your Stream Analytics deployments can be fully automated. 
15+
16+
A managed identity is a managed application registered in Azure Active Directory that represents a given Stream Analytics job. The managed application is used to authenticate to a targeted resource. For more information on managed identities for Azure Stream Analytics, see [Managed identities for Azure Stream Analytics](stream-analytics-managed-identities-overview.md).
17+
18+
This article shows you how to enable system-assigned managed identity for a Cosmos DB output of a Stream Analytics job through the Azure portal. Before you can enable system-assigned managed identity, you must first have a Stream Analytics job and an Azure Cosmos DB resource.
19+
20+
## Create a managed identity 
21+
22+
First, you create a managed identity for your Azure Stream Analytics job. 
23+
24+
1. In the Azure portal, open your Azure Stream Analytics job. 
25+
26+
2. From the left navigation menu, select **Managed Identity** located under *Configure*. Then, check the box next to **Use System-assigned Managed Identity** and select **Save**.
27+
28+
:::image type="content" source="media/event-hubs-managed-identity/system-assigned-managed-identity.png" alt-text="System assigned managed identity"::: 
29+
30+
3. A service principal for the Stream Analytics job's identity is created in Azure Active Directory. The life cycle of the newly created identity is managed by Azure. When the Stream Analytics job is deleted, the associated identity (that is, the service principal) is automatically deleted by Azure. 
31+
32+
When you save the configuration, the Object ID (OID) of the service principal is listed as the Principal ID as shown below: 
33+
34+
:::image type="content" source="media/event-hubs-managed-identity/principal-id.png" alt-text="Principal ID":::
35+
36+
The service principal has the same name as the Stream Analytics job. For example, if the name of your job is `MyASAJob`, the name of the service principal is also `MyASAJob`. 
37+
38+
## Grant the Stream Analytics job permissions to access the Azure Cosmos DB account
39+
40+
For the Stream Analytics job to access your Cosmos DB using managed identity, the service principal you created must have special permissions to your Azure Cosmos DB account. In this step, you can assign a role to your stream analytics job's system-assigned managed identity. Azure Cosmos DB has multiple built-in roles that you can assign to the managed identity. For this solution, you can use the following two roles:
41+
42+
|Built-in role |Description |
43+
|---------|---------|
44+
|[DocumentDB Account Contributor](../role-based-access-control/built-in-roles.md#documentdb-account-contributor)|Can manage Azure Cosmos DB accounts. Allows retrieval of read/write keys. |
45+
|[Cosmos DB Account Reader Role](../role-based-access-control/built-in-roles.md#cosmos-db-account-reader-role)|Can read Azure Cosmos DB account data. Allows retrieval of read keys. |
46+
47+
> [!TIP]
48+
> When you assign roles, assign only the needed access. If your service requires only reading data, then assign the **Cosmos DB Account Reader** role to the managed identity. For more information about the importance of least privilege access, see the [Lower exposure of privileged accounts](../security/fundamentals/identity-management-best-practices.md#lower-exposure-of-privileged-accounts) article.
49+
50+
1. Select **Access control (IAM)**.
51+
52+
2. Select **Add** > **Add role assignment** to open the **Add role assignment** page.
53+
54+
3. Assign the following role. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md).
55+
56+
| Setting | Value |
57+
| --- | --- |
58+
| Role | DocumentDB Account Contributor |
59+
| Assign access to | User, group, or service principal |
60+
| Members | \<Name of your Stream Analytics job> |
61+
62+
![Screenshot that shows Add role assignment page in Azure portal.](../../includes/role-based-access-control/media/add-role-assignment-page.png)
63+
64+
> [!NOTE]
65+
> Due to global replication or caching latency, there may be a delay when permissions are revoked or granted. Changes should be reflected within 8 minutes.
66+
67+
68+
### Add the Cosmos DB as an output
69+
70+
Now that your managed identity is configured, you're ready to add the Cosmos DB resource as an output to your Stream Analytics job. 
71+
72+
1. Go to your Stream Analytics job and navigate to the **Outputs** page under **Job Topology**.
73+
74+
1. Select **Add > Cosmos DB**. In the output properties window, search and select your Cosmos DB account and select **Managed Identity: System assigned** from the *Authentication mode* drop-down menu.
75+
76+
1. Fill out the rest of the properties and select **Save**.
77+
78+
## Next steps
79+
80+
* [Understand outputs from Azure Stream Analytics](stream-analytics-define-outputs.md)
81+
* [Azure Cosmos DB Output](azure-cosmos-db-output.md)
82+
* [Quickstart: Create a Stream Analytics job by using the Azure portal](stream-analytics-quick-create-portal.md)
83+
* [Cosmos DB Optimization](stream-analytics-documentdb-output.md)

‎articles/stream-analytics/service-bus-managed-identity.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
title: Use managed identities to access Service Bus from an Azure Stream Analytics job
3+
description: This article describes how to use managed identities to authenticate your Azure Stream Analytics job to an Azure Service Bus output.
4+
author: enkrumah
5+
ms.author: ebnkruma
6+
ms.service: stream-analytics
7+
ms.topic: how-to
8+
ms.date: 05/04/2022
9+
ms.custom: subject-rbac-steps
10+
---
11+
12+
# Use managed identities to access Service Bus from an Azure Stream Analytics job (preview)
13+
14+
Azure Stream Analytics supports managed identity authentication for both Azure Service Bus output. Managed identities for Azure resources is a cross-Azure feature that enables you to create a secure identity associated with the deployment under which your application code runs. You can then associate that identity with access-control roles that grant custom permissions for accessing specific Azure resources that your application needs.
15+
16+
With managed identities, the Azure platform manages this runtime identity. You do not need to store and protect access keys in your application code or configuration, either for the identity itself, or for the resources you need to access. For more information on managed identities for Azure Stream Analytics, see [Managed identities for Azure Stream Analytics](stream-analytics-managed-identities-overview.md).
17+
18+
This article shows you how to enable system-assigned managed identity for a Service Bus output of a Stream Analytics job through the Azure portal. Before you can enable system-assigned managed identity, you must first have a Stream Analytics job and an Azure Service Bus resource.
19+
20+
## Create a managed identity 
21+
22+
First, you create a managed identity for your Azure Stream Analytics job. 
23+
24+
1. In the Azure portal, open your Azure Stream Analytics job. 
25+
26+
2. From the left navigation menu, select **Managed Identity** located under *Configure*. Then, check the box next to **Use System-assigned Managed Identity** and select **Save**.
27+
28+
:::image type="content" source="media/event-hubs-managed-identity/system-assigned-managed-identity.png" alt-text="System assigned managed identity"::: 
29+
30+
3. A service principal for the Stream Analytics job's identity is created in Azure Active Directory. The life cycle of the newly created identity is managed by Azure. When the Stream Analytics job is deleted, the associated identity (that is, the service principal) is automatically deleted by Azure. 
31+
32+
When you save the configuration, the Object ID (OID) of the service principal is listed as the Principal ID as shown below: 
33+
34+
:::image type="content" source="media/event-hubs-managed-identity/principal-id.png" alt-text="Principal ID":::
35+
36+
The service principal has the same name as the Stream Analytics job. For example, if the name of your job is `MyASAJob`, the name of the service principal is also `MyASAJob`. 
37+
38+
## Grant the Stream Analytics job permissions to access Azure Service Bus
39+
40+
For the Stream Analytics job to access your Service Bus using managed identity, the service principal you created must have special permissions to your Azure Service Bus resource. In this step, you can assign a role to your stream analytics job's system-assigned managed identity. Azure provides the below Azure built-in roles for authorizing access to a Service Bus namespace:
41+
42+
- [Azure Service Bus Data Owner](../role-based-access-control/built-in-roles.md#azure-service-bus-data-owner): Enables data access to Service Bus namespace and its entities (queues, topics, subscriptions, and filters)
43+
- [Azure Service Bus Data Sender](../role-based-access-control/built-in-roles.md#azure-service-bus-data-sender): Use this role to give send access to Service Bus namespace and its entities.
44+
- [Azure Service Bus Data Receiver](../role-based-access-control/built-in-roles.md#azure-service-bus-data-receiver): Use this role to give receiving access to Service Bus namespace and its entities.
45+
46+
> [!TIP]
47+
> When you assign roles, assign only the needed access. For more information about the importance of least privilege access, see the [Lower exposure of privileged accounts](../security/fundamentals/identity-management-best-practices.md#lower-exposure-of-privileged-accounts) article.
48+
49+
1. Select **Access control (IAM)**.
50+
51+
2. Select **Add** > **Add role assignment** to open the **Add role assignment** page.
52+
53+
3. Assign the following role. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.md).
54+
55+
| Setting | Value |
56+
| --- | --- |
57+
| Role | Azure Service Bus Data Owner |
58+
| Assign access to | User, group, or service principal |
59+
| Members | \<Name of your Stream Analytics job> |
60+
61+
![Screenshot that shows Add role assignment page in Azure portal.](../../includes/role-based-access-control/media/add-role-assignment-page.png)
62+
63+
> [!NOTE]
64+
> Due to global replication or caching latency, there may be a delay when permissions are revoked or granted. Changes should be reflected within 8 minutes.
65+
66+
67+
### Add the Service Bus as an output
68+
69+
Now that your managed identity is configured, you're ready to add the Service Bus resource as an output to your Stream Analytics job. 
70+
71+
1. Go to your Stream Analytics job and navigate to the **Outputs** page under **Job Topology**.
72+
73+
1. Select **Add > Service Bus queue or Service Bus topic**. In the output properties window, search and select your Cosmos DB account and select **Managed Identity: System assigned** from the *Authentication mode* drop-down menu.
74+
75+
1. Fill out the rest of the properties and select **Save**.
76+
77+
## Next steps
78+
79+
* [Understand outputs from Azure Stream Analytics](stream-analytics-define-outputs.md)
80+
* [Quickstart: Create a Stream Analytics job by using the Azure portal](stream-analytics-quick-create-portal.md)
81+

0 commit comments

Comments
 (0)