Other Articles

Cosmos DB – Restrict Firewall Network Access

This check ensures that Azure Cosmos DB DocumentDB accounts are protected by firewall rules and restricted network access. Access should be limited to approved IP ranges or virtual networks to prevent unauthorised public exposure.

Check Details

  • Resource: Azure Cosmos DB (DocumentDB)
  • Check: Ensure Firewall and Network Restrictions Are Configured
  • Risk: If network access is unrestricted, Cosmos DB accounts may be accessible from the public internet, increasing the risk of data breaches, unauthorised access, and exploitation of exposed database endpoints.

Remediation via Azure Portal

  1. Log in to the Azure Portal. Azure Portal dashboard
  2. Navigate to Azure Cosmos DB and select the affected database account. Azure Cosmos DB accounts list
  3. In the left-hand menu, select Networking under Settings. Cosmos DB networking settings
  4. Under Public network access, ensure access is not set to allow all networks. Cosmos DB Virtual networking
  5. Under Firewall, configure:
    • Allow access only from selected IP addresses.
    • Or enable access through specific Virtual Networks.
  6. Click Save to apply the configuration.

Remediation via Azure CLI

  1. Open Azure Cloud Shell or a local terminal with Azure CLI installed. Azure Cloud Shell
  2. Restrict public network access to selected networks: 
    az cosmosdb update \
 --resource-group <resource-group> \
 --name <cosmos-account-name> \
 --public-network-access Disabled
  3. Add a specific IP address to the firewall: 
    az cosmosdb network-rule add \
 --resource-group <resource-group> \
 --name <cosmos-account-name> \
 --ip-address <approved-ip-address>
  4. Verify network configuration: 
    az cosmosdb show \
 --resource-group <resource-group> \
 --name <cosmos-account-name> \
 --query "{publicNetworkAccess:publicNetworkAccess, ipRules:ipRules}"

Ensure that publicNetworkAccess is set to "Disabled" or restricted, and only approved IP addresses or virtual networks are permitted.