Azure CosmosDB

Azure Cosmos DB is a fully managed NoSQL, relational, and vector database. It offers single-digit millisecond response times, automatic and instant scalability, along with guaranteed speed at any scale.

Relyance AI currently supports integration with MongoDB and NoSQL instances of CosmosDB. Support for additional instances such as PostgresSQL is in development.

The CosmosDB integration has two options to connect:

1. Using MongoDB Instance
2. Using NoSQL Instance

Using MongoDB Instance

In order to integrate MongoDB with Relyance AI using certificate authorization, you will need:

1. Host name
2. Port number
3. Relyance AI NAT IP Addresses ( Relyance AI IP Addresses for Allow Lists )
4. Username
5. Password

In CosmosDB:

1. Login to your Azure account and navigate to Azure Cosmos DB

2. From the CosmosDB homepage, select the MongoDB instance

3. Allow-list the Relyance Production NAT IP:

   1. Click on Networking, choose 'Selected networks', and add all the Relyance NAT IP addresses from the article Relyance AI IP Addresses for Allow Lists in the list of allowed IPs

4. Note the Host, Port, Username, Password

   1. Click on Connection Strings and make a note of the Host, Port, and Username
   2. Then click on the 'Read only Keys' tab in the same screen and note the Primary Password

   

In the Relyance AI application:

1. Login to your Relyance account
2. Navigate to the Settings Menu in the bottom left-hand side
3. Select Integrations
4. Search for CosmosDB
5. In the CosmosDB integration card, and click it to open its connections.
6. Under Authentication Method, choose MongoDB.
7. Add the values for Host, User, Port, Password with the values noted from the Azure console
8. Select the Enable Data Inspection checkbox if you wish Relyance AI also toinspect the data (this is when Relyance AI analyzes a sample of your dataset in addition to scanning the data schema/metadata)
9. Click on Connect to complete the integration
10. At this point, you should be successfully connected to CosmosDB. Relyance AI will now trigger a scan and the results will appear in various modules of the platform such as Visual Maps, Data Flow Analysis etc.

Using NoSQL Instance

In order to integrate NoSQL with Relyance AI you will need Account Endpoint, Account Key and the Relyance AI Production NAT IP.

In CosmosDB:

1. Login to your Azure account and navigate to Azure Cosmos DB

2. From the CosmosDB homepage, select the NoSQL instance

3. Allow-list the Relyance Production NAT IP:

   1. Click on Networking, choose 'Selected Networks' and add all the Relyance NAT IP addresses from the article Relyance AI IP Addresses for Allow Lists in the list of allowed IPs

4. Note the Account Endpoint and Account Key

   1. Select Keys
   2. The account endpoint is the URI and the Primary Key (under Read-only Keys) is the Account Key

   

   

   

In the Relyance AI application:

1. Login to your Relyance account
2. Navigate to the Settings Menu in the bottom left-hand side
3. Select Integrations
4. Search for CosmosDB
5. In the CosmosDB integration card, and click it to open its connections.
6. Under Authentication Method, choose Custom.
7. Enter the Account Endpoint and Account Key that were noted from the Azure console
8. Select the Enable Data Inspection checkbox if you wish Relyance AI also toinspect the data (this is when Relyance AI analyzes a sample of your dataset in addition to scanning the data schema/metadata)

10. Click Authenticate
11. Congratulations, you are now connected to CosmosDB. Relyance AI will now trigger a scan and the results will appear in various modules of the platform such as Visual Maps, Data Flow Analysis etc.

Verify the connection is really working

The method follows the account's API, not a preference: a Cosmos DB account created for NoSQL (Core) authenticates with an Account Endpoint and Account Key, and one created for the MongoDB API authenticates with Host, Port, User and Password. An account cannot use the other form, so if the fields on the Authentication step do not match what the Azure portal shows you, the connection is pointed at the wrong API.

1. A failure at Authenticate with a valid-looking key is usually the firewall. Cosmos DB accounts default to denying public network access, so the account's Networking panel has to admit the Relyance egress IPs for your tenant's region — all of the addresses listed there, not one of them.
2. Use a read-only key. Cosmos DB issues both primary and read-only keys, and scanning needs only the read-only one. Pasting a primary key grants far more than the scan uses.
3. Rotating the key breaks the connection silently. Cosmos DB key regeneration invalidates the stored value immediately; the connection keeps its last status until the next scan attempt fails. Re-paste the key on the connection after any rotation.
4. Connected but nothing classified means Data Inspection was not enabled. Without it the scan reads schema and metadata only — which is a valid configuration, so nothing reports an error.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

NoSQL

resource "relyance_integration_connection" "azure_db_cosmosdb_0" {
  vendor = "azure_db_cosmosdb"
  name   = "<your connection name>"

  auth = {
    method = "no-sql-auth"
    params = {
      account_endpoint = "<account_endpoint>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      account_key = var.azure_db_cosmosdb_account_key
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}

MongoDB

resource "relyance_integration_connection" "azure_db_cosmosdb_1" {
  vendor = "azure_db_cosmosdb"
  name   = "<your connection name>"

  auth = {
    method = "mongo-db-auth"
    params = {
      host = "<host>"
      port = "<port>"
      user = "<user>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      pw = var.azure_db_cosmosdb_pw
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}