Cosmos DB firewall allows only selected networks

Check ID: cosmosdb_account_firewall_use_selected_networks
Provider: Azure
Service: cosmosdb
Severity: MEDIUM
Categories: internet-exposed, trust-boundaries
Resource type: microsoft.documentdb/databaseaccounts

What this check verifies

Azure Cosmos DB accounts limit connectivity to selected networks using virtual network rules and/or IP allowlists rather than permitting access from all networks. The evaluation determines whether the account’s network firewall enforces this restriction.

Risk

Access from all networks enlarges the attack surface. If keys or tokens are exposed or privileges are misconfigured, attackers anywhere can read or modify data, harming confidentiality and integrity. Weak segmentation also enables SSRF/pivot paths from Azure services and can impact availability through abuse.

Recommendation

Set network access to Selected networks with least privilege:

Prefer private endpoints or VNet service endpoints with subnet ACLs
Keep IP allowlists minimal; avoid 0.0.0.0
When feasible, set publicNetworkAccess=Disabled with Private Link
Apply defense in depth and monitor access and firewall changes

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az cosmosdb network-rule add -g <RESOURCE_GROUP> -n <ACCOUNT_NAME> —subnet <example_resource_id>

# Enable Cosmos DB VNet firewall and allow a specific subnet
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = azurerm_resource_group.<example_resource_name>.location
  resource_group_name = azurerm_resource_group.<example_resource_name>.name
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  consistency_policy { consistency_level = "Session" }
  geo_location { location = azurerm_resource_group.<example_resource_name>.location failover_priority = 0 }

  is_virtual_network_filter_enabled = true  # CRITICAL: Enforces selected networks only
  virtual_network_rule {
    id = "<example_resource_id>"           # CRITICAL: Subnet resource ID allowed to access the account
  }
}

// Enable selected networks only by turning on VNet filter and adding one allowed subnet
resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
  name: '<example_resource_name>'
  location: '<LOCATION>'
  properties: {
    databaseAccountOfferType: 'Standard'
    locations: [{ locationName: '<LOCATION>'; failoverPriority: 0 }]
    isVirtualNetworkFilterEnabled: true // CRITICAL: Enables VNet firewall (selected networks only)
    virtualNetworkRules: [
      {
        id: '<example_resource_id>' // CRITICAL: Subnet resource ID allowed to access the account
      }
    ]
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = cosmosdb_account_firewall_use_selected_networks. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Container Registry uses a private endpoint (Private Link)Cosmos DB uses Entra ID authentication with Azure RBAC

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires