Cosmos DB Operator
← Back to DP-420 Terminology Reference
Category: Maintenance & Security
Summary: Provisions accounts, databases, and containers; cannot access data or use Data Explorer.
Overview
Cosmos DB Operator is a built-in Azure RBAC (control-plane/ARM) role that lets you provision Azure Cosmos DB accounts, databases, and containers, but cannot access any data (item reads/writes) or use Data Explorer, and cannot read account keys/connection strings. It is distinct from Cosmos DB Account Reader Role (which can read account data), Cosmos Backup Operator (which manages periodic backup restore requests), and CosmosRestoreOperator (which restores continuous-backup accounts) — Cosmos DB Operator is purely about provisioning infrastructure.
More Info & Links
DP-420 Style Practice Questions
Q1. What can the Cosmos DB Operator built-in role do?
- A. Provision Azure Cosmos DB accounts, databases, and containers, without accessing data or using Data Explorer
- B. Read item data using Data Explorer
- C. Restore a deleted Azure Cosmos DB account
- D. Submit a periodic backup restore request
Q2. Why does the Cosmos DB Operator role exclude access to Data Explorer and account data?
- A. To enforce least privilege, separating infrastructure provisioning from data access
- B. Because it is a deprecated role
- C. Because it only applies to the MongoDB API
- D. Because data access is managed exclusively through Cosmos Backup Operator
Answer Key
Answers are listed at the very end so you can attempt the questions first.
- Q1 (Cosmos DB Operator): A. Provision Azure Cosmos DB accounts, databases, and containers, without accessing data or using Data Explorer — Cosmos DB Operator can provision accounts, databases, and containers, but explicitly cannot access data or use Data Explorer.
- Q2 (Cosmos DB Operator): A. To enforce least privilege, separating infrastructure provisioning from data access — Excluding Data Explorer/data access lets an operator provision resources (control plane) without being able to read or modify the actual data (data plane).
DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page
