Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Control Plane operations are not supported with RBAC #2446

Open
sevoku opened this issue Nov 20, 2024 · 0 comments
Open

Control Plane operations are not supported with RBAC #2446

sevoku opened this issue Nov 20, 2024 · 0 comments

Comments

@sevoku
Copy link
Member

sevoku commented Nov 20, 2024

Control Plane operations are not supported with the data plane SDK and we need to switch to control plane when using RBAC: https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/how-to-grant-control-plane-role-based-access?tabs=built-in-definition%2Ccsharp&pivots=azure-interface-portal

Repro steps:

  1. Navigate to a NoSQL account with localAuth disabled or after enabling the azureDatabases.useCosmosOAuth setting
  2. Select the "Create Database..." command from the accounts context menu or run cosmosDB.createDocDBDatabase from the command palette.
  3. Give the database a name and hit Enter

Expected: database gets created

Actual: Error is logged (see below).

Action: cosmosDB.createDocDBDatabase
Error type: 403
Error Message: Request blocked by Auth redacted:username-test-nosql : The given request [POST /dbs] cannot be authorized by AAD redacted:key data plane. Learn more: redacted:url
ActivityId: redacted:id, redacted:url

Version: 0.24.1-alpha
OS: darwin
OS Release: 24.1.0
Product: Visual Studio Code - Insiders
Product Version: 1.96.0-insider
Language: en

Call Stack
httpRequest @azure/RequestHandler.js:95:1
@azure/retryUtility.js:44:1
addDignosticChild @azure/diagnostics.js:44:1
addDignosticChild @azure/diagnostics.js:44:1
ClientContext.create @azure/ClientContext.js:236:1
Databases.createInternal @azure/Databases.js:90:1
withDiagnostics @azure/diagnostics.js:100:1
Proxy.createChildImpl DocDBAccountTreeItemBase.ts:99:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant