title: Create database inside Azure Cosmos DB account with RBAC
body: <p>I use java version 4 SDK for azure cosmos db. I want to create database inside azure cosmos db account with service principal, not with masterkey.</p>
  <p>I assigned to service principal <code>DocumentDB Account Contributor</code> and <code>Cosmos DB Operator</code> built-in-role definitions, according to this documentation:</p>
  <p><a href="https://docs.microsoft.com/pl-pl/azure/role-based-access-control/built-in-roles#cosmos-db-operator" rel="nofollow noreferrer">https://docs.microsoft.com/pl-pl/azure/role-based-access-control/built-in-roles#cosmos-db-operator</a></p>
  <p>I was not able to create CosmosAsyncClient, until I added new custom role, which just contains reading metadata. Above mentioned built-in-role definitions do not contain it...</p>
  <pre><code> TokenCredential ServicePrincipal = new ClientSecretCredentialBuilder()
              .authorityHost(&quot;https://login.microsoftonline.com&quot;)
              .tenantId(tenant_here)
              .clientId(clientid_here)
              .clientSecret(secret_from_above_client)
              .build();
  
   client = new CosmosClientBuilder()
                              .endpoint(AccountSettings.HOST)
                              .credential(ServicePrincipal)
                              .buildAsyncClient();
  </code></pre>
  <p>After I added this role, client was created, but I am not able to create database instance and also container inside it as next step. In access control I can see that roles are assigned so service principal is correct here.</p>
  <p>What is more, when firstly I create database and container with master key and then I want to read/write data using service principal, it works (obviously after adding custom role for writting also).</p>
  <p>Then I do not know why <code>DocumentDB Account Contributor</code> and <code>Cosmos DB Operator</code> does not work for creation database.</p>