Controlplane app how to#
Controlplane app update#

Controlplane app how to#

The following screenshot shows how to enable control plane logs:Īfter you turn on logging, use the following steps to track down operations for a specific account: All the control plane operations performed after that point can be tracked. After you enable, it takes a few minutes for the diagnostic logs to take effect. This article shows how to send logs to log analytics and then query them. You can also store the logs in a storage account or stream to an event hub. Select ControlPlaneRequests for log type and select the Send to Log Analytics option. Open the Diagnostic settings pane, provide a Name for the logs to create. Sign into Azure portal and navigate to your Azure Cosmos account. Use the following steps to enable logging on control plane operations: For example, the RegionFailoverStart and RegionFailoverComplete will complete the region failover event. After enabling, the diagnostic logs will record the operation as a pair of start and complete events with relevant details. You can enable diagnostic logs for control plane operations by using the Azure portal. Alternatively, you can use Azure portal, Azure CLI, Azure PowerShell, or Azure Resource Manager template deployments to perform these operations.Įnable diagnostic logs for control plane operations When disableKeyBasedMetadataWriteAccess is set to true, the metadata operations issued by the SDK are blocked.

Controlplane app update#

Make sure to change the value of disableKeyBasedMetadataWriteAccess to false instead of true.Ĭonsider the following points when turning off the metadata write access:Įvaluate and ensure that your applications do not make metadata calls that change the above resources (For example, create collection, update throughput, …) by using the SDK or account keys. To switch back, set the disableKeyBasedMetadataWriteAccess to false by using Azure CLI as described in the Preventing changes from Cosmos SDK article. You have to turn on access to such operations for your account, or perform the create/update operations through Azure Resource Manager, Azure CLI or Azure PowerShell. To learn more on how to set this property, see the Preventing changes from SDKs article.Īfter the disableKeyBasedMetadataWriteAccess is turned on, if the SDK based clients run create or update operations, an error 'Operation 'POST' on resource 'ContainerNameorDatabaseName' is not allowed through Azure Cosmos DB endpoint is returned. After you set this property, changes to any resource can happen from a user with the proper Azure role and credentials. You can disable write access by setting the disableKeyBasedMetadataWriteAccess property to true. When key based metadata write access is disabled, clients connecting to the Azure Cosmos account through account keys are prevented from accessing the account. For example, a VNet was changed.īefore you audit the control plane operations in Azure Cosmos DB, disable the key-based metadata write access on your account. You want to get more details from the diagnostic logs on what has changed. This alert will help you detect an accidental addition or removal of region on your account.

Adding or removing regions has implications on billing and data sovereignty requirements.

You want to get an alert if a new region is added or removed from your Azure Cosmos account. The alert is required to find unauthorized modifications to rules that govern the network security of your Azure Cosmos account and take quick action. You want to get an alert when the firewall rules for your Azure Cosmos account are modified. The following are some example scenarios where auditing control plane operations is helpful: You can run the control plane operations on Azure Cosmos accounts by using Azure CLI, PowerShell or Azure portal, whereas for containers, use Azure CLI or PowerShell. This article explains how to audit the control plane operations in Azure Cosmos DB. are some of the control plane operations. For example, operations such as create an Azure Cosmos account, add a region, update throughput, region failover, add a VNet etc. The control plane operations include changes to the Azure Cosmos account or container. It exposes a public resource model (for example: database, account) and various operations to the end users to perform actions on the resource model. Control Plane in Azure Cosmos DB is a RESTful service that enables you to perform a diverse set of operations on the Azure Cosmos account.