Give permission to Managed Identity to write index policy of Cosmos DB container

Question

Is there a role or an action that can be assigned to a Managed Identity to allow it to write the index policy of a Cosmos DB container?

Neither DocumentDB Account Contributor nor Cosmos DB Operator nor Owner seem to suffice.

The code for writing the index policy using the .NET CosmosClient looks like this:

ContainerResponse containerResponse = await this.container.ReadContainerAsync();

containerResponse.Resource.IndexingPolicy = ...; // set or manipulate the index policy

await this.container.ReplaceContainerAsync(containerResponse.Resource);

Answer 1

You cannot use Data Plane SDKs such as Microsoft.Azure.Cosmos to perform Management Plane operations when using MSI authentication.

The operation you are attempting is probably failing with an error, that error has an aka.ms link in its message that points to: https://learn.microsoft.com/azure/cosmos-db/how-to-setup-rbac#permission-model

To perform Management Plane operations with MSI auth you need to use the Management Plane SDKs, such as Azure.ResourceManager.CosmosDB for .NET.