# Azure CosmosDB

![Azure Cosmos DB RU's Consumption. All the operations we perform on Azure… | by Mohammad Shaved | Medium](https://assets.relyanceuat.xyz/images/docs/25857388578189/ext-08ae04afbf.png)
Azure Cosmos DB is a fully managed NoSQL, relational, and vector database. It offers single-digit millisecond response times, automatic and instant scalability, along with guaranteed speed at any scale.

Relyance AI currently supports integration with MongoDB and NoSQL instances of CosmosDB. Support for additional instances such as PostgresSQL is in development.

The CosmosDB integration has two options to connect:

1. [Using MongoDB Instance](#h_01HSCTCYCSW0XD7E7KWCT93K9Y)
2. [Using NoSQL Instance](#h_01HSCTBNHDXXF5TDJVXD3VXDG6)

### Using MongoDB Instance

In order to integrate MongoDB with Relyance AI using certificate authorization, you will need:

1. Host name
2. Port number
3. Relyance AI NAT IP Addresses ( [Relyance AI IP Addresses for Allow Lists](/docs/integrations/relyance-ai-ip-addresses-for-allow-lists/) )
4. Username
5. Password

#### In CosmosDB:

1. Login to your Azure account and navigate to Azure Cosmos DB
2. From the CosmosDB homepage, select the MongoDB instance
3. **Allow-list the Relyance Production NAT IP**:
    1. Click on **Networking,** choose 'Selected networks', and add all the Relyance NAT IP addresses from the article [Relyance AI IP Addresses for Allow Lists](/docs/integrations/relyance-ai-ip-addresses-for-allow-lists/) in the list of allowed IPs
4. Note the Host, Port, Username, Password
    1. Click on Connection Strings and make a note of the Host, Port, and Username
    2. Then click on the 'Read only Keys' tab in the same screen and note the Primary Password

    ![Screenshot](https://assets.relyanceuat.xyz/images/docs/25857388578189/25857395555853.png)

#### In the Relyance AI application:

1. Login to your Relyance account
2. Navigate to the **Settings** Menu in the bottom left-hand side
3. Select **Integrations**
4. Search for CosmosDB
5. In the CosmosDB integration card, and click it to open its connections.
6. Under **Authentication Method**, choose **MongoDB**.
8. Add the values for Host, User, Port, Password with the values noted from the Azure console
9. Select the **Enable** *Data Inspection* checkbox if you wish Relyance AI also toinspect the data (this is when Relyance AI analyzes a sample of your dataset in addition to scanning the data schema/metadata)
11. Click on Connect to complete the integration
12. At this point, you should be successfully connected to **CosmosDB.** Relyance AI will now trigger a scan and the results will appear in various modules of the platform such as Visual Maps, Data Flow Analysis etc.

### Using NoSQL Instance

In order to integrate NoSQL with Relyance AI you will need **Account Endpoint, Account Key** and the **Relyance AI Production NAT IP**.

#### In CosmosDB:

1. Login to your Azure account and navigate to Azure Cosmos DB
2. From the CosmosDB homepage, select the NoSQL instance
3. **Allow-list the Relyance Production NAT IP**:
    1. Click on **Networking,** choose 'Selected Networks' and add all the Relyance NAT IP addresses from the article [Relyance AI IP Addresses for Allow Lists](/docs/integrations/relyance-ai-ip-addresses-for-allow-lists/) in the list of allowed IPs
4. Note the Account Endpoint and Account Key
    1. Select Keys
    2. The account endpoint is the URI and the Primary Key (under Read-only Keys) is the Account Key

    ![Screenshot](https://assets.relyanceuat.xyz/images/docs/25857388578189/25858107011341.png)

    ![Screenshot](https://assets.relyanceuat.xyz/images/docs/25857388578189/25858107021965.png)

    ![Screenshot](https://assets.relyanceuat.xyz/images/docs/25857388578189/25858107030925.png)

#### In the Relyance AI application:

1. Login to your Relyance account
2. Navigate to the **Settings** Menu in the bottom left-hand side
3. Select **Integrations**
4. Search for CosmosDB
5. In the CosmosDB integration card, and click it to open its connections.
6. Under **Authentication Method**, choose **Custom**.
8. Enter the **Account Endpoint** and **Account Key** that were noted from the Azure console
9. Select the **Enable** *Data Inspection* checkbox if you wish Relyance AI also toinspect the data (this is when Relyance AI analyzes a sample of your dataset in addition to scanning the data schema/metadata)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/25857388578189/25857388569997.png)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/25857388578189/25858136907533.png)

10. Click **Authenticate**
11. Congratulations, you are now connected to **CosmosDB.** Relyance AI will now trigger a scan and the results will appear in various modules of the platform such as Visual Maps, Data Flow Analysis etc.

### Verify the connection is really working

The method follows the account's API, not a preference: a Cosmos DB account
created for **NoSQL (Core)** authenticates with an **Account Endpoint** and
**Account Key**, and one created for the **MongoDB API** authenticates with
**Host**, **Port**, **User** and **Password**. An account cannot use the other
form, so if the fields on the Authentication step do not match what the Azure
portal shows you, the connection is pointed at the wrong API.

1. **A failure at Authenticate with a valid-looking key** is usually the firewall.
   Cosmos DB accounts default to denying public network access, so the account's
   **Networking** panel has to admit the
   [Relyance egress IPs](/docs/integrations/relyance-ai-ip-addresses-for-allow-lists/)
   for your tenant's region — all of the addresses listed there, not one of them.
2. **Use a read-only key.** Cosmos DB issues both primary and read-only keys, and
   scanning needs only the read-only one. Pasting a primary key grants far more
   than the scan uses.
3. **Rotating the key breaks the connection silently.** Cosmos DB key regeneration
   invalidates the stored value immediately; the connection keeps its last status
   until the next scan attempt fails. Re-paste the key on the connection after any
   rotation.
4. **Connected but nothing classified** means **Data Inspection** was not enabled.
   Without it the scan reads schema and metadata only — which is a valid
   configuration, so nothing reports an error.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### NoSQL

```hcl
resource "relyance_integration_connection" "azure_db_cosmosdb_0" {
  vendor = "azure_db_cosmosdb"
  name   = "<your connection name>"

  auth = {
    method = "no-sql-auth"
    params = {
      account_endpoint = "<account_endpoint>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      account_key = var.azure_db_cosmosdb_account_key
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

### MongoDB

```hcl
resource "relyance_integration_connection" "azure_db_cosmosdb_1" {
  vendor = "azure_db_cosmosdb"
  name   = "<your connection name>"

  auth = {
    method = "mongo-db-auth"
    params = {
      host = "<host>"
      port = "<port>"
      user = "<user>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      pw = var.azure_db_cosmosdb_pw
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->