az cosmosdb sql container create command with a client Encryption Policy attached does NOT actually create the policy

Describe the bug

When running az cosmosdb sql container create -g "<resource-group>" -a "<account>" -d "<database>" -n "<container>" --partition-key-path "/partitionKey" --cep @policy-file.json , the Encryption Policy is not applied.

Command Name

az cosmosdb sql container create

Errors:

None

To Reproduce:

Steps to reproduce the behavior.

1. create a cosmosdb database - done via the azure portal
2. create a ClientEncryptionKey (created via Powershell as I have not found a Azure CLI native command to do this) $myKeyWrapMetadataObject = [Microsoft.Azure.Commands.CosmosDB.Models.PSSqlKeyWrapMetadata]::new([Microsoft.Azure.Management.CosmosDB.Models.KeyWrapMetadata]::new("key1","AZURE_KEY_VAULT", "url-to-key-vault-key", "RSA-OAEP")) New-AzCosmosDbClientEncryptionKey -AccountName $accountName -DatabaseName $databaseName -ResourceGroupName "d-weu-shrd-rg" -Name $keyName -EncryptionAlgorithmName "AEAD_AES_256_CBC_HMAC_SHA256" -KeyWrapMetadata $myKeyWrapMetadataObject
3. create a container with an encryption policy via Azure CLI az cosmosdb sql container create -g "<resource-group>" -a "<account>" -d "<database>" -n "<container>" --partition-key-path "/partitionKey" --cep @policy-file.json Content of the policy-file.json { "includedPaths": [ { "path": "/password", "clientEncryptionKeyId": "key1", "encryptionAlgorithm": "AEAD_AES_256_CBC_HMAC_SHA256", "encryptionType": "Deterministic" } ], "policyFormatVersion": 2 }

Current Behavior

Below is the output from the az cosmosdb sql container create command

Expected Behavior

This is the output of the az cosmosdb sql container show command run against a container created via the .Net CosmosSDK. Code is located in the azure-cosmos-dotnet-v3 repo in the samples .sln, encryption project. It shows the encryption policies.

Environment Summary tried locally on my Windows 10 Enterprise 20H2, as well as in the Azure Devops pipeline CLI task

azure-cli 2.42.0

[pavelplesca]

Solution worked. Thanks a lot.

[SaurabhSharma-MSFT]

@pavelplesca If you want to use the old cli, use bash task to install old CLI:

# Specify python version
- task: UsePythonVersion@0
  inputs:
    versionSpec: '3.x'
    architecture: 'x64'
 
# Update to a specify Azure CLI version
- bash: |
    pip install -Iv azure-cli==X.XX.X --extra-index-url https://azurecliprod.blob.core.windows.net/edge
    az --version
  displayName: 'Use Azure CLI X.XX.X'

Please Note:

Since the Keys used in the policy should be created upfront. Azure CLI does not support creating Client Encryption Keys. We do have Powershell support that you can leverage which provides support to create Client Encryption Keys and containers with Client Encryption Policy. Please refer to the below documentations -

• New-AzCosmosDbClientEncryptionKey (Az.CosmosDB) | Microsoft Learn
• New-AzCosmosDBSqlContainer (Az.CosmosDB) | Microsoft Learn Please let me know if you have any other questions. Thanks