question

RRanjiniCW-8638 avatar image
0 Votes"
RRanjiniCW-8638 asked RRanjiniCW-8638 commented

How can we set re try logic between primary and secondary cosmos keys in azure function app.

I have a Function with a Cosmos DB Trigger, which is used to consume cosmos DB change feed.
we have policy in place to rotate the cosmos keys every month and update it in the key vault. The application setting has a single connection string.

Is there anyway to implement re try logic to connect with secondary keys when primary is not available.

azure-functions
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

MayankBargali-MSFT avatar image
0 Votes"
MayankBargali-MSFT answered RRanjiniCW-8638 commented

@RRanjiniCW-8638 Unfortunately you cannot assign two keys to the Azure cosmos DB trigger and retry with primary/secondary keys would not be possible if you have rotation the keys or the keys are invalid.

You can use Key Vault references for Azure Functions and the latest keys are fetch from the key vault but the app will automatically update and begin using the latest version within one day. Any configuration changes made to the your function will cause an immediate update to the latest versions of all referenced secrets.
If you don't want to use the keys then you can use managed identity based authentication.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@MayankBargali-MSFT
Thank you for the reply, I turned on the managed Identity on the function app and added it at the cosmosDB. But I am unable to find a way how to let the function app know it has to use the managed identity, as the input binding which is automatically created still points to the connection string.
see below:

{
"bindings": [
{
"type": "cosmosDBTrigger",
"name": "input",
"direction": "in",
"leaseCollectionName": "leases",
"connectionStringSetting": "ConfigurableLookUpDataTrigger_ConnectionString",
"databaseName": "PrismDB",
"collectionName": "ConfigurableLookUpData",
"createLeaseCollectionIfNotExists": true
}
]
}



0 Votes 0 ·

@RRanjiniCW-8638 You cannot use cosmosDB trigger. The document shared previously uses timmer trigger and Consmo DB SDK to communicate with Consmo DB. The keys are retrived using consmo DB listkeys API.

0 Votes 0 ·

@MayankBargali-MSFT Thank you for your help, I am trying a way if I can re start the function app after I rotate the keys in automation account. Will confirm if that works.

1 Vote 1 ·