Ensure public network access disabled for Azure CosmosDB Account

MEDIUM

Description

Allowing unrestricted, public access to cloud services could open an application up to external attack. Disallowing this access is typically considered best practice.

Remediation

In Azure Console -

  1. Open the Azure Portal and go to Cosmos DB.
  2. Select the Cosmos DB account you wish to edit.
  3. Under Settings, choose Networking.
  4. On the Public access tab, set Public network access to disabled.

In Terraform -

  1. In the azurerm_cosmosdb_account resource, set public_network_access_enabled to false.

References:
https://learn.microsoft.com/en-us/azure/cosmos-db/
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/cosmosdb_account#public_network_access_enabled

Policy Details

Rule Reference ID: AC_AZURE_0316
CSP: Azure
Remediation Available: Yes
Resource Category: Database
Resource Type: Cosmos DB Account

Frameworks