Retrieve AccountKey or ConnectionString from DocumentDB-Account using Pulumi

Question

I create a CosmosDB/DocumentDB - Account using AzureNextGen:

var databaseAccount=new Pulumi.AzureNextGen.DocumentDB.Latest.DatabaseAccount(accountName, 
  new Pulumi.AzureNextGen.DocumentDB.Latest.DatabaseAccountArgs
  {
    // parameters
  }
);

To be able to access this database afterwards I need to retrieve either the key or connection string of that databaseaccount:

I can build the first part of the connection string (the endpoint) via databaseAccount.DocumentEndpoint.Apply(q => "AccountEndpoint=" + q) but I am stuck getting the more crucial part, the key.

How can this be achieved?

Answer 1

Azure API doesn't return any sensitive data automatically. You need to run an explicit query for any secret data.

In this case, you should use functions listDatabaseAccountKeys and listDatabaseAccountConnectionStrings for this purpose. Here is a snippet in TypeScript:

const keys = pulumi.all([resourceGroupName, databaseAccount.name])
    .apply(([resourceGroupName, accountName]) =>
        documentdb.listDatabaseAccountKeys({ resourceGroupName, accountName }));

const connectionStrings = pulumi.all([resourceGroupName, databaseAccount.name])
    .apply(([resourceGroupName, accountName]) =>
        documentdb.listDatabaseAccountConnectionStrings({ resourceGroupName, accountName }));

const connectionString = connectionStrings.apply(cs => cs.connectionStrings![0].connectionString);
const masterKey = keys.primaryMasterKey;

Copied from this example.

When translating to C#, you'd use Output.Tuple instead of pulumi.all like in this template.

Answer 2

Based on Mikhails answer the C# - code to retrieve the primary key is as follows:

var keys = Pulumi.AzureNextGen.DocumentDB.Latest.ListDatabaseAccountKeys.InvokeAsync(
new Pulumi.AzureNextGen.DocumentDB.Latest.ListDatabaseAccountKeysArgs
{
  AcccountName = "databasename",
  ResourceGroupName = "resourcename"
});

var key = Output.Create(keys).Apply(q => q.PrimaryMasterKey);