Description:

This check verifies that Azure Cosmos DB accounts use Private Endpoints to provide secure connectivity over the Azure Private Link service. Private Endpoints assign a private IP address from a virtual network (VNet), allowing access to Cosmos DB without exposing traffic to the public internet.


Rationale:

By default, Azure Cosmos DB can be accessed through public endpoints. Although access can be controlled using firewalls and network rules, public endpoints still increase the attack surface. Private Endpoints provide secure, private connectivity between Azure resources and Cosmos DB over Microsoft's backbone network, reducing the risk of unauthorized access and data exposure.


Impact:

  • Reduces exposure of Cosmos DB accounts to the public internet.

  • Minimizes the risk of unauthorized access and data exfiltration.

  • Enhances network security through private connectivity.

  • Supports compliance requirements for data protection and network isolation.

  • Improves security posture by eliminating dependency on public IP-based access controls.


Default Value:

By default, Azure Cosmos DB accounts are accessible through public endpoints. Private Endpoints must be explicitly configured and associated with a Virtual Network.


Remediation:

Test Plan:

Using Azure Portal:

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Cosmos DB.

  3. Select the Cosmos DB account.

  4. Under Settings, select Networking.

  5. Review the Public network access configuration.

  6. Select the Private Endpoint Connections tab.

  7. Verify whether one or more approved private endpoints exist.

  8. Confirm that applications access Cosmos DB through the private endpoint.


Implementation steps:

Using Azure Portal:

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Cosmos DB.

  3. Select the affected Cosmos DB account.

  4. Select Networking.

  5. Under Private Endpoint Connections, click + Private Endpoint.

  6. Configure:

    • Subscription

    • Resource Group

    • Virtual Network

    • Subnet

  7. Review and create the Private Endpoint.

  8. Approve the connection if required.

  9. Validate DNS resolution using Azure Private DNS Zones.

  10. Once connectivity is confirmed, disable public network access if business requirements allow.

Disable Public Access (Recommended)

  1. Navigate to Networking.

  2. Under Public Network Access, select Disabled.

  3. Save changes.

  4. Validate application connectivity through the Private Endpoint.


Backout Plan:

Using Azure Portal:

  1. Navigate to the Cosmos DB account.

  2. Select Networking.

  3. Re-enable Public Network Access if application connectivity is impacted.

  4. Remove or disconnect the Private Endpoint if required.

  5. Validate application access and functionality.


References: