Search code examples
azureazure-devopsazure-cosmosdb

Get Cosmos DB account primary account key/primary connection string with Azure cli/PowerShell

I am creating an Azure DevOps release pipeline in which I want to FETCH the primary account key/primary connection string of the cosmos db account as part of an Azue CLI task and publish it as a task variable so that I can use that as parameter for the Data Factory ARM deployment activity which is a subsequent task in the same pipeline. The code I used to fetch the key is:

az cosmosdb keys list \
   --name <db_account_name> \
   --resource-group <resource_group_name> \
   --subscription <subscription_name> \
   --type connection-strings \
   --query 'connectionStrings[0].connectionString' \
   --output tsv

The code returns

AccountEndpoint=https://<db_account_name>.documents.azure.com:443/;AccountKey=***;

But it does not show the string content inside the account key.

When I store this as a task variable and use the same for ARM tasks, I get error.

  1. how to get the text content of the cosmos db account primary connection string/account key through Azure cli/tasks that are part of azure devops pipeline?
  2. do I need to change the RBAC roles for the profile that I use to access cosmos db account from Azure pipeline?
Solution

  • how to get the text content of the cosmos db account primary connection string/account key through azure cli/tasks that are part of azure devops pipeline?

    I could not reproduce your issue, it works fine on my side, the AccountKey was output as plain text.

    My inline script:

    $a = az cosmosdb keys list --name joycosmostest --resource-group <groupname> --subscription <subscription-id> --type connection-strings --query 'connectionStrings[0].connectionString' --output tsv

echo "##vso[task.setvariable variable=connectionString;isOutput=true]$a"

    enter image description here

    enter image description here

    do I need to change the RBAC roles for the profile that I use to access cosmos db account from azure pipeline?

    In Azure CLI Task, it uses the Azure Resource Manager service connection to auth Azure Service, so you should make sure the service principal used in the service connection has a correct RBAC role in your cosmos db account e.g. Contributor.