Secure, optimize, and deploy database solutions
Separate the two planes of access
Control-plane roles (Owner, Contributor, Cosmos DB Account Reader) let you manage the account but grant no data. Data-plane access uses Microsoft Entra ID with the built-in SQL roles (Cosmos DB Built-in Data Contributor or Data Reader) assigned through a role definition and assignment, or a resource token broker pattern that scopes a user to a partition key through stored procedures. Account keys bypass RBAC entirely - if a question wants to force Entra-only access, the answer is to set disableLocalAuth to true. Rotate keys by updating the secondary key, then the primary. Network controls are IP firewall rules, virtual network service endpoints, and Private Link, with customer-managed keys for encryption at rest.
Throughput and cost tuning
Choose provisioned throughput, autoscale (which scales between 10 percent of the maximum and the maximum), or serverless for spiky, low-volume workloads. Diagnose throttling with the normalized RU consumption metric rather than raw RU consumption: sustained values near 100 percent on a partition indicate a hot partition, which a partition-key redesign fixes more cheaply than raising throughput. HTTP 429 responses are retried by the SDK; enable AllowBulkExecution for large ingestion. Also consider TTL for expiry, the integrated cache with a dedicated gateway for repeated point reads, and query tuning (avoid cross-partition fan-out, project fewer properties).
Deployment discipline
Provision accounts and containers with Bicep, ARM, or Terraform in idempotent pipelines, use database-level shared throughput where possible, and change throughput in code rather than by hand. Traps: service endpoints do not replace firewall rules, and contributing to an account does not let an identity read items.