Work with account keys and connection strings for an Azure Cosmos DB account using Azure CLI
APPLIES TO:
NoSQL
MongoDB
Cassandra
Gremlin
Table
The script in this article demonstrates four operations.
- List all account keys
- List read only account keys
- List connection strings
- Regenerate account keys
This script shows Azure Cosmos DB for NoSQL examples, but these operations are identical across all database APIs in Azure Cosmos DB.
If you don't have an Azure subscription, create an Azure free account before you begin.
Prerequisites
Use the Bash environment in Azure Cloud Shell. For more information, see Quickstart for Bash in Azure Cloud Shell.
If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.
If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.
When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.
Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.
- This article requires version 2.9.1 or later of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
Sample script
Launch Azure Cloud Shell
The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.
To open the Cloud Shell, just select Try it from the upper right corner of a code block. You can also launch Cloud Shell in a separate browser tab by going to https://shell.azure.com.
When Cloud Shell opens, verify that Bash is selected for your environment. Subsequent sessions will use Azure CLI in a Bash environment, Select Copy to copy the blocks of code, paste it into the Cloud Shell, and press Enter to run it.
Sign in to Azure
Cloud Shell is automatically authenticated under the initial account signed-in with. Use the following script to sign in using a different subscription, replacing subscriptionId with your Azure subscription ID.
If you don't have an Azure subscription, create an Azure free account before you begin.
subscription="subscriptionId" # Set Azure subscription ID here
az account set -s $subscription # ...or use 'az login'
For more information, see set active subscription or log in interactively.
Run the script
# Account key operations for an Azure Cosmos account
# Variable block
let "randomIdentifier=$RANDOM*$RANDOM"
location="East US"
resourceGroup="msdocs-cosmosdb-rg-$randomIdentifier"
tag="keys-cosmosdb"
account="msdocs-account-cosmos-$randomIdentifier" #needs to be lower case
# Create a resource group
echo "Creating $resourceGroup in $location..."
az group create --name $resourceGroup --location "$location" --tags $tag
# Create a Cosmos DB account with default values
# Use appropriate values for --kind or --capabilities for other APIs
echo "Creating $account for CosmosDB"
az cosmosdb create --name $account --resource-group $resourceGroup
# List all account keys
az cosmosdb keys list --name $account --resource-group $resourceGroup
# List read-only keys
az cosmosdb keys list --name $account --resource-group $resourceGroup --type read-only-keys
# List connection strings
az cosmosdb keys list --name $account --resource-group $resourceGroup --type connection-strings
# Regenerate secondary account keys
# key-kind values: primary, primaryReadonly, secondary, secondaryReadonly
az cosmosdb keys regenerate --name $account --resource-group $resourceGroup --key-kind secondary
Clean up resources
Use the following command to remove the resource group and all resources associated with it using the az group delete command - unless you have an ongoing need for these resources. Some of these resources may take a while to create, as well as to delete.
az group delete --name $resourceGroup
Sample reference
This script uses the following commands. Each command in the table links to command specific documentation.
| Command | Notes |
|---|---|
| az group create | Creates a resource group in which all resources are stored. |
| az cosmosdb create | Creates an Azure Cosmos DB account. |
| az cosmosdb keys list | List the keys for an Azure Cosmos DB account. |
| az cosmosdb keys list --type read-only-keys | List the read only keys for an Azure Cosmos DB account. |
| az cosmosdb keys list --type connection-strings | List the connection strings for an Azure Cosmos DB account. |
| az cosmosdb keys regenerate | Regenerate an access key for an Azure Cosmos DB database account. |
| az group delete | Deletes a resource group including all nested resources. |
Next steps
For more information on the Azure Cosmos DB CLI, see Azure Cosmos DB CLI documentation.
For Azure CLI samples for specific APIs see: