Skip to content

Restrict user access to data operations in Azure Cosmos DB#

Security · Cosmos DB · Rule · 2021_09 · Important

Use Entra ID identities for management place operations in Azure Cosmos DB.

Description#

Cosmos DB provides two authorization options for interacting with the database:

  • Entra ID identities (previously known as Azure AD). Can be used to authorize account and resource management operations.
  • Keys and resource tokens. Can be used to authorize resource management and data operations.

Resource management operations include management of databases, indexes, and containers. By default, keys are permitted to perform resource management operations. You can restrict these operations to Azure Resource Manager (ARM) calls only.

Recommendation#

Consider limiting key and resource tokens to data plane operations only. Use Microsoft Entra ID identities for authorizing account and resource management operations.

Examples#

Configure with Azure template#

To deploy Cosmos DB accounts that pass this rule:

  • Set the Properties.disableKeyBasedMetadataWriteAccess property to true.

For example:

Azure Template snippet
{
  "type": "Microsoft.DocumentDB/databaseAccounts",
  "apiVersion": "2023-04-15",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "properties": {
    "consistencyPolicy": {
      "defaultConsistencyLevel": "Session"
    },
    "databaseAccountOfferType": "Standard",
    "locations": [
      {
        "locationName": "[parameters('location')]",
        "failoverPriority": 0,
        "isZoneRedundant": true
      }
    ],
    "disableKeyBasedMetadataWriteAccess": true
  }
}

Configure with Bicep#

To deploy Cosmos DB accounts that pass this rule:

  • Set the Properties.disableKeyBasedMetadataWriteAccess property to true.

For example:

Azure Bicep snippet
resource account 'Microsoft.DocumentDB/databaseAccounts@2023-04-15' = {
  name: name
  location: location
  properties: {
    consistencyPolicy: {
      defaultConsistencyLevel: 'Session'
    }
    databaseAccountOfferType: 'Standard'
    locations: [
      {
        locationName: location
        failoverPriority: 0
        isZoneRedundant: true
      }
    ]
    disableKeyBasedMetadataWriteAccess: true
  }
}

Comments