Cosmos DB account uses private endpoint connections

# Create a Private Endpoint to a Cosmos DB account (adds a private endpoint connection)
resource "azurerm_private_endpoint" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  subnet_id           = "<example_subnet_id>"

  private_service_connection {
    name                           = "<example_resource_name>"
    private_connection_resource_id = "<example_cosmosdb_account_id>" # CRITICAL: Cosmos DB account ID
    subresource_names              = ["Sql"]                           # CRITICAL: targets Cosmos DB subresource to create the connection
  }
}

// Create a Private Endpoint to a Cosmos DB account (adds a private endpoint connection)
resource pe 'Microsoft.Network/privateEndpoints@2025-05-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  properties: {
    subnet: { id: '<example_subnet_id>' }
    privateLinkServiceConnections: [
      {
        name: 'conn'
        properties: {
          privateLinkServiceId: '<example_cosmosdb_account_id>' // CRITICAL: attaches PE to the Cosmos DB account
          groupIds: ['Sql'] // CRITICAL: targets Cosmos DB NoSQL subresource so the connection is created
        }
      }
    ]
  }
}