View source for Cosmos DB Operator

&larr; Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Provisions accounts, databases, and containers; cannot access data or use Data Explorer.

== Overview ==
Cosmos DB Operator is a built-in Azure RBAC (control-plane/ARM) role that lets you provision Azure Cosmos DB accounts, databases, and containers, but cannot access any data (item reads/writes) or use Data Explorer, and cannot read account keys/connection strings. It is distinct from Cosmos DB Account Reader Role (which can read account data), Cosmos Backup Operator (which manages periodic backup restore requests), and CosmosRestoreOperator (which restores continuous-backup accounts) — Cosmos DB Operator is purely about provisioning infrastructure.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases#cosmos-db-operator Microsoft Learn: Azure built-in roles for Azure Cosmos DB]

== DP-420 Style Practice Questions ==
'''Q1.''' What can the Cosmos DB Operator built-in role do?
* A. Provision Azure Cosmos DB accounts, databases, and containers, without accessing data or using Data Explorer
* B. Read item data using Data Explorer
* C. Restore a deleted Azure Cosmos DB account
* D. Submit a periodic backup restore request

'''Q2.''' Why does the Cosmos DB Operator role exclude access to Data Explorer and account data?
* A. To enforce least privilege, separating infrastructure provisioning from data access
* B. Because it is a deprecated role
* C. Because it only applies to the MongoDB API
* D. Because data access is managed exclusively through Cosmos Backup Operator

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Cosmos DB Operator):''' A. Provision Azure Cosmos DB accounts, databases, and containers, without accessing data or using Data Explorer — Cosmos DB Operator can provision accounts, databases, and containers, but explicitly cannot access data or use Data Explorer.
* '''Q2 (Cosmos DB Operator):''' A. To enforce least privilege, separating infrastructure provisioning from data access — Excluding Data Explorer/data access lets an operator provision resources (control plane) without being able to read or modify the actual data (data plane).

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]