Skip to content

Commit 40c33d5

Browse files
GinSiuChengGinSiuCheng
authored
Cosmosdb l100 examples (microsoft#100)
1 parent e0f9c4b commit 40c33d5

File tree

30 files changed

+1906
-0
lines changed

30 files changed

+1906
-0
lines changed

‎quickstart/101-cosmos-db-aad-rbac/README.md‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
# Cosmos db with role definition and assignment
2+
This template deploys a cosmos db account with sql db and aad role definition and assignment. A similar example can be created using the [azurerm/cosmosdb module](https://github.com/azure/terraform-azurerm-cosmosdb).
3+
4+
## Terraform resource types
5+
- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
6+
- [azurerm_cosmosdb_account](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cosmosdb_account)
7+
- [azurerm_cosmosdb_sql_database](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cosmosdb_sql_database)
8+
- [azurerm_cosmosdb_sql_container](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cosmosdb_sql_container)
9+
- [azurerm_cosmosdb_sql_role_assignment](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cosmosdb_sql_role_assignment)
10+
- [azurerm_cosmosdb_sql_role_definition](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cosmosdb_sql_role_definition)
11+
12+
## Variables
13+
14+
| Name | Description |
15+
|-|-|
16+
| `resource_group_name` | Resource group name |
17+
| `resource_group_location` | Resource group location |
18+
| `cosmosdb_account_name` | Cosmos db account name |
19+
| `cosmosdb_location` | Cosmos db primary location |
20+
| `throughput` | DB manual throughput |
21+
| `sql_container_name` | Name of sql container |
22+
23+
## Example terraform.tfvars file
24+
```
25+
resource_group_name = "rg-cosmosdb-101"
26+
location = "centralus"
27+
cosmosdb_account_name = "cosmosdb-dev-centralus-101"
28+
cosmosdb_account_location = "centralus"
29+
cosmosdb_sqldb_name = "sqlapidb"
30+
throughput = 400
31+
sql_container_name = "example-container"
32+
```
33+
34+
## Usage
35+
36+
```bash
37+
>terraform plan
38+
39+
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
40+
+ create
41+
42+
Terraform will perform the following actions:
43+
44+
# azurerm_cosmosdb_account.example will be created
45+
+ resource "azurerm_cosmosdb_account" "example" {
46+
+ access_key_metadata_writes_enabled = true
47+
+ analytical_storage_enabled = false
48+
+ connection_strings = (sensitive value)
49+
+ create_mode = (known after apply)
50+
+ default_identity_type = "FirstPartyIdentity"
51+
+ enable_automatic_failover = false
52+
+ enable_free_tier = false
53+
+ enable_multiple_write_locations = false
54+
+ endpoint = (known after apply)
55+
+ id = (known after apply)
56+
+ is_virtual_network_filter_enabled = false
57+
+ kind = "GlobalDocumentDB"
58+
+ local_authentication_disabled = false
59+
+ location = "centralus"
60+
+ mongo_server_version = (known after apply)
61+
+ name = "cosmosdb-dev-centralus-101"
62+
+ network_acl_bypass_for_azure_services = false
63+
+ offer_type = "Standard"
64+
+ primary_key = (sensitive value)
65+
+ primary_readonly_key = (sensitive value)
66+
+ public_network_access_enabled = true
67+
+ read_endpoints = (known after apply)
68+
+ resource_group_name = "rg-cosmosdb-101"
69+
+ secondary_key = (sensitive value)
70+
+ secondary_readonly_key = (sensitive value)
71+
+ write_endpoints = (known after apply)
72+
73+
+ analytical_storage {
74+
+ schema_type = (known after apply)
75+
}
76+
77+
+ backup {
78+
+ interval_in_minutes = (known after apply)
79+
+ retention_in_hours = (known after apply)
80+
+ storage_redundancy = (known after apply)
81+
+ type = (known after apply)
82+
}
83+
84+
+ capabilities {
85+
+ name = (known after apply)
86+
}
87+
88+
+ capacity {
89+
+ total_throughput_limit = (known after apply)
90+
}
91+
92+
+ consistency_policy {
93+
+ consistency_level = "BoundedStaleness"
94+
+ max_interval_in_seconds = 300
95+
+ max_staleness_prefix = 100000
96+
}
97+
98+
+ geo_location {
99+
+ failover_priority = 0
100+
+ id = (known after apply)
101+
+ location = "centralus"
102+
+ zone_redundant = false
103+
}
104+
}
105+
106+
# azurerm_cosmosdb_sql_container.example will be created
107+
+ resource "azurerm_cosmosdb_sql_container" "example" {
108+
+ account_name = "cosmosdb-dev-centralus-101"
109+
+ database_name = "sqlapidb"
110+
+ default_ttl = (known after apply)
111+
+ id = (known after apply)
112+
+ name = "example-container"
113+
+ partition_key_path = "/definition/id"
114+
+ partition_key_version = 1
115+
+ resource_group_name = "rg-cosmosdb-101"
116+
+ throughput = 400
117+
118+
+ conflict_resolution_policy {
119+
+ conflict_resolution_path = (known after apply)
120+
+ conflict_resolution_procedure = (known after apply)
121+
+ mode = (known after apply)
122+
}
123+
124+
+ indexing_policy {
125+
+ indexing_mode = "consistent"
126+
127+
+ excluded_path {
128+
+ path = "/excluded/?"
129+
}
130+
131+
+ included_path {
132+
+ path = "/*"
133+
}
134+
+ included_path {
135+
+ path = "/included/?"
136+
}
137+
}
138+
139+
+ unique_key {
140+
+ paths = [
141+
+ "/definition/idlong",
142+
+ "/definition/idshort",
143+
]
144+
}
145+
}
146+
147+
# azurerm_cosmosdb_sql_database.example will be created
148+
+ resource "azurerm_cosmosdb_sql_database" "example" {
149+
+ account_name = "cosmosdb-dev-centralus-101"
150+
+ id = (known after apply)
151+
+ name = "sqlapidb"
152+
+ resource_group_name = "rg-cosmosdb-101"
153+
+ throughput = 400
154+
}
155+
156+
# azurerm_cosmosdb_sql_role_assignment.example will be created
157+
+ resource "azurerm_cosmosdb_sql_role_assignment" "example" {
158+
+ account_name = "cosmosdb-dev-centralus-101"
159+
+ id = (known after apply)
160+
+ name = (known after apply)
161+
+ principal_id = "1b887731-4609-4904-a699-64f06f3d380d"
162+
+ resource_group_name = "rg-cosmosdb-101"
163+
+ role_definition_id = (known after apply)
164+
+ scope = "/subscriptions/aa86e73d-372b-4cd6-a37e-0d12ae93e964/resourceGroups/rg-cosmosdb-101/providers/Microsoft.DocumentDB/databaseAccounts/cosmosdb-dev-centralus-101"
165+
}
166+
167+
# azurerm_cosmosdb_sql_role_definition.example will be created
168+
+ resource "azurerm_cosmosdb_sql_role_definition" "example" {
169+
+ account_name = "cosmosdb-dev-centralus-101"
170+
+ assignable_scopes = [
171+
+ "/subscriptions/aa86e73d-372b-4cd6-a37e-0d12ae93e964/resourceGroups/rg-cosmosdb-101/providers/Microsoft.DocumentDB/databaseAccounts/cosmosdb-dev-centralus-101",
172+
]
173+
+ id = (known after apply)
174+
+ name = "examplesqlroledef"
175+
+ resource_group_name = "rg-cosmosdb-101"
176+
+ role_definition_id = (known after apply)
177+
+ type = "CustomRole"
178+
179+
+ permissions {
180+
+ data_actions = [
181+
+ "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read",
182+
]
183+
}
184+
}
185+
186+
# azurerm_resource_group.example will be created
187+
+ resource "azurerm_resource_group" "example" {
188+
+ id = (known after apply)
189+
+ location = "centralus"
190+
+ name = "rg-cosmosdb-101"
191+
}
192+
193+
Plan: 6 to add, 0 to change, 0 to destroy.
194+
195+
Changes to Outputs:
196+
+ cosmosdb_account_id = (known after apply)
197+
+ cosmosdb_sql_database_id = (known after apply)
198+
```
199+

‎quickstart/101-cosmos-db-aad-rbac/main.tf‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
resource "azurerm_resource_group" "example" {
4+
name = var.resource_group_name
5+
location = var.location
6+
}
7+
8+
resource "azurerm_cosmosdb_account" "example" {
9+
name = var.cosmosdb_account_name
10+
location = var.cosmosdb_account_location
11+
resource_group_name = azurerm_resource_group.example.name
12+
offer_type = "Standard"
13+
kind = "GlobalDocumentDB"
14+
enable_automatic_failover = false
15+
geo_location {
16+
location = var.location
17+
failover_priority = 0
18+
}
19+
20+
consistency_policy {
21+
consistency_level = "BoundedStaleness"
22+
max_interval_in_seconds = 300
23+
max_staleness_prefix = 100000
24+
}
25+
26+
depends_on = [
27+
azurerm_resource_group.example
28+
]
29+
}
30+
31+
resource "azurerm_cosmosdb_sql_database" "example" {
32+
name = var.cosmosdb_sqldb_name
33+
resource_group_name = azurerm_resource_group.example.name
34+
account_name = azurerm_cosmosdb_account.example.name
35+
throughput = var.throughput
36+
}
37+
38+
resource "azurerm_cosmosdb_sql_container" "example" {
39+
name = var.sql_container_name
40+
resource_group_name = azurerm_resource_group.example.name
41+
account_name = azurerm_cosmosdb_account.example.name
42+
database_name = azurerm_cosmosdb_sql_database.example.name
43+
partition_key_path = "/definition/id"
44+
partition_key_version = 1
45+
throughput = 400
46+
47+
indexing_policy {
48+
indexing_mode = "consistent"
49+
50+
included_path {
51+
path = "/*"
52+
}
53+
54+
included_path {
55+
path = "/included/?"
56+
}
57+
58+
excluded_path {
59+
path = "/excluded/?"
60+
}
61+
}
62+
63+
unique_key {
64+
paths = ["/definition/idlong", "/definition/idshort"]
65+
}
66+
}
67+
68+
resource "azurerm_cosmosdb_sql_role_definition" "example" {
69+
name = "examplesqlroledef"
70+
resource_group_name = azurerm_resource_group.example.name
71+
account_name = azurerm_cosmosdb_account.example.name
72+
type = "CustomRole"
73+
assignable_scopes = ["/subscriptions/${data.azurerm_client_config.current.subscription_id}/resourceGroups/${azurerm_resource_group.example.name}/providers/Microsoft.DocumentDB/databaseAccounts/${azurerm_cosmosdb_account.example.name}"]
74+
75+
permissions {
76+
data_actions = ["Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read"]
77+
}
78+
}
79+
80+
resource "azurerm_cosmosdb_sql_role_assignment" "example" {
81+
resource_group_name = azurerm_resource_group.example.name
82+
account_name = azurerm_cosmosdb_account.example.name
83+
role_definition_id = azurerm_cosmosdb_sql_role_definition.example.id
84+
principal_id = data.azurerm_client_config.current.object_id
85+
scope = "/subscriptions/${data.azurerm_client_config.current.subscription_id}/resourceGroups/${azurerm_resource_group.example.name}/providers/Microsoft.DocumentDB/databaseAccounts/${azurerm_cosmosdb_account.example.name}"
86+
}

‎quickstart/101-cosmos-db-aad-rbac/outputs.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "cosmosdb_account_id" {
2+
value = azurerm_cosmosdb_account.example.id
3+
}
4+
5+
output "cosmosdb_sql_database_id" {
6+
value = azurerm_cosmosdb_sql_database.example.id
7+
}

‎quickstart/101-cosmos-db-aad-rbac/providers.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
terraform {
2+
required_providers {
3+
azurerm = {
4+
source = "hashicorp/azurerm"
5+
version = ">=3.0.0"
6+
}
7+
}
8+
}
9+
10+
provider "azurerm" {
11+
features {}
12+
}

‎quickstart/101-cosmos-db-aad-rbac/variables.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
variable "resource_group_name" {
2+
type = string
3+
description = "Resource group name"
4+
}
5+
6+
variable "location" {
7+
type = string
8+
description = "Resource group location"
9+
}
10+
11+
variable "cosmosdb_account_name" {
12+
type = string
13+
description = "Cosmos db account name"
14+
}
15+
16+
variable "cosmosdb_account_location" {
17+
type = string
18+
description = "Cosmos db account location"
19+
}
20+
21+
variable "cosmosdb_sqldb_name" {
22+
type = string
23+
description = "value"
24+
}
25+
26+
variable "throughput" {
27+
type = number
28+
description = "Cosmos db database throughput"
29+
validation {
30+
condition = var.throughput >= 400 && var.throughput <= 1000000
31+
error_message = "Cosmos db manual throughput should be equal to or greater than 400 and less than or equal to 1000000."
32+
}
33+
validation {
34+
condition = var.throughput % 100 == 0
35+
error_message = "Cosmos db throughput should be in increments of 100."
36+
}
37+
}
38+
39+
variable "sql_container_name" {
40+
type = string
41+
description = "SQL API container name."
42+
}

0 commit comments

Comments
 (0)