How to configure a linked service to Cosmos DB (SQL API) with a linked service to Azure Key Vault with parameterized database

DevWeb 6 Reputation points
2022-10-07T22:23:12.797+00:00

With Azure Data Factory UI experience, one can create a linked service to Cosmos DB (SQL API) with a linked service to Azure Key Vault using the Account Key type authentication. In this particular scenario, we have added secrets to the Azure Key Vault for the Cosmos DB connection string but we do not want the connection string to include "Database=xxx" as we would like to parameterize that so that we do not have to add connection strings for each Cosmos DB databases to the key vault. Unfortunately, the UI does not offer any option for us to specify "Database=xxx" to the Cosmos DB-linked service using Azure Key Vault. You can switch to use Connection String mode, but then one would have to pass in Cosmos DB Uri and then use the access key from Azure Key Valut secret. Do we have any option here using a linked service to Azure Key Vault to construct a linked service to Cosmos DB with a parameter for the Database name?

248614-image.png

248615-image.png

Azure Data Factory
Azure Data Factory

An Azure service for ingesting, preparing, and transforming data at scale.

0 comments
Answer accepted by question author
KranthiPakala-MSFT 46,832 Reputation points Moderator
2022-10-11T01:02:15.077+00:00

Hello @XiangChenxchen1-7804,

Thanks for the question and using MS Q&A platform.

If you use Azure Key vault mode after the Account Selection method settings, then you won't be able to parameterize your database name as you will have to provide the complete connection string in the AKV. You cannot pass the parameters values to AKV to validate the connection string.

Hence you will have to take second approach to go with Connection String mode after Account selection method settings. Then you will be able to save your Account key in Key vault and also you can parameterize the accountEndpoint in the URI section as well as you can parameterize the database name and pass them at runtime using pipeline parameters as needed.

Please see below for more info:

249124-image.png

Here is a sample JSON payload of my test DBName parameterized linked service: 

{  
	"name": "CosmosDb1SQLApiParameterizedDB",  
	"properties": {  
		"parameters": {  
			"DBName": {  
				"type": "string",  
				"defaultValue": "DefaultDBName"  
			},  
			"accountEndpoint": {  
				"type": "string",  
				"defaultValue": "DefaultEnpointName"  
			}  
		},  
		"annotations": [],  
		"type": "CosmosDb",  
		"typeProperties": {  
			"connectionString": "AccountEndpoint=https://@{linkedService().accountEndpoint}.documents.azure.com:443/;Database=@{linkedService().DBName}",  
			"accountKey": {  
				"type": "AzureKeyVaultSecret",  
				"store": {  
					"referenceName": "xxxxxxxSharedAKVLS",  
					"type": "LinkedServiceReference"  
				},  
				"secretName": "xxxxxxxCosmosDbSQLAPIConnStringWithDBParam",  
				"secretVersion": "56xxxxxxxxxxxxxxxxxxxxxxxxx6fe42"  
			}  
		}  
	},  
	"type": "Microsoft.DataFactory/factories/linkedservices"  
}

Hope this will help. Please let us know if any further queries.

------------------------------

  • Please don't forget to click on 130616-image.png or upvote 130671-image.png button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how

Was this answer helpful?

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.