Custom - Data Reader doesnt work in VS Code Azure Extension

[ganger-gaurav]

Hi.

I have PIM access to Custom - Data Reader on one of the resource groups

When I try to access Cosmos, everything works, and I can read data from that RG

However, when I try to access from the VS Code Azure extension, I get not authorised error.

Could you please check what's wrong here?

Thanks

[sevoku]

@ganger-gaurav unfortunately you can't set data plane RBAC permissions using Azure Portal, you need to follow the steps for data plane here: https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/how-to-connect-role-based-access-control?pivots=azure-cli#grant-data-plane-role-based-access. But at the same time, the extension can't do control plane (i.e. create db or container) operations with RBAC. You'll need to use Data Explorer in the portal then or enable key based auth for your account (known issue #2446).

[ganger-gaurav]

@sevoku Thanks for your reply. When I enable the Contributor role, I can access all data in VS Code and in Azure, allowing me to edit it on both platforms.

However, I activated read-only (Data Reader) permissions because I only want to view and not change anything. But for that, I get Unauthorised in VS Code, but it works properly on Azure. Is the read-only PIM access not supported on the VS Code Azure extension?

[sevoku]

Sorry for the late follow up @ganger-gaurav. I'm a bit confused, so you're saying that if you assign the Contributor role (the one listed under "Priviledged administrator roles" with the ID /providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c) you can access the data using this extension? Or is it some other custom role?
Because that doesn't work for me and to my understanding it's expected according to the docs, since that Contributor role is only for resource management (control plane) and not data. But I'm by far not an expert in the RBAC area, I'll double check with the team.

And nevertheless have you tried setting the appropriate dataActions permissions for data plane as described in the Grant data plane role-based access section? You don't need to create a custom role btw, simply use the predefined roles (you can get the full id using az cosmosdb sql role definition list):

• Cosmos DB Built-in Data Reader: sqlRoleDefinitions/00000000-0000-0000-0000-000000000001
• Cosmos DB Built-in Data Contributor: sqlRoleDefinitions/00000000-0000-0000-0000-000000000002