How do I grant an application Microsoft.Kusto/clusters/databases/dataConnections/read access over a specific database in Kusto?

Question

I am trying to grant an application read access to the data connections of a specific database in Kusto. How do I grant this permission to this managed identity? There is not a place within the azure portal to grant this permission at the database level. I am trying to avoid granting this permission at the cluster level. This is the error I am receiving from my app.

The client 'id' with object id 'id' does not have authorization to perform action 'Microsoft.Kusto/clusters/databases/dataConnections/read' over scope '/subscriptions/subscription/resourceGroups/RG/providers/Microsoft.Kusto/clusters/cluster/databases/database-foo'

I tried going to the azure portal to grant my app this permission, but there is no IAM tab within the database. The cluster does have the IAM tab, but I am avoiding adding the permission there for security reasons.

No IAM place to add permissions of this type IAM available in cluster

Answer 1

You can grant Microsoft.Kusto/clusters/databases/dataConnections/read access under cluster IAM only, not under specific database in Kusto for resource administration like listing data connections.

When I tried to list these data connections by running below REST API call without assigning role, I too got same error as below:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Kusto/clusters/{clusterName}/databases/{databaseName}/dataConnections?api-version=2023-08-15

Response:

To resolve the error, you need to assign proper RBAC role like Reader under database cluster as below:

When I tried to list these data connections by running below REST API call after assigning role, I got response successfully:

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Kusto/clusters/{clusterName}/databases/{databaseName}/dataConnections?api-version=2023-08-15

Response:

Reference: Role-based access control in Kusto - Azure Data Explorer | Microsoft