AzInitiativeAdvertizer

last sync: 2025-Oct-31 18:22:44 UTC

Enforce recommended guardrails for Cosmos DB

Source

Display name

Enforce recommended guardrails for Cosmos DB

Enforce-Guardrails-CosmosDb

Version

Category

Cosmos DB

Description

This policy initiative is a group of policies that ensures Cosmos DB is compliant per regulated Landing Zones.

Cloud environments

AzureChinaCloud
AzureCloud
AzureUSGovernment

Type

Custom Azure Landing Zones (ALZ)

Deprecated

False

Preview

False

Policy-used summary

Policy types	Policy states	Policy categories
Total Policies: 6 Builtin Policies: 6 Static Policies: 0 ALZ Policies: 0	GA: 6	1 categories: Cosmos DB: 6

Policy-used

Policy DisplayName	Policy Id	Category	Effect	Roles#	Roles	State	Type	policy in AzUSGov
Azure Cosmos DB accounts should have firewall rules	862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb	Cosmos DB	Default Deny Allowed Audit, Deny, Disabled	0		GA	BuiltIn	true
Azure Cosmos DB key based metadata write access should be disabled	4750c32b-89c0-46af-bfcb-2e4541a818d5	Cosmos DB	Fixed append	0		GA	BuiltIn	unknown
Configure Cosmos DB database accounts to disable local authentication	dc2d41d1-4ab1-4666-a3e1-3d51c43e0049	Cosmos DB	Default Modify Allowed Modify, Disabled	1	DocumentDB Account Contributor	GA	BuiltIn	true
Configure CosmosDB accounts to disable public network access	da69ba51-aaf1-41e5-8651-607cd0b37088	Cosmos DB	Default Modify Allowed Modify, Disabled	2	Contributor, DocumentDB Account Contributor	GA	BuiltIn	true
Cosmos DB database accounts should have local authentication methods disabled	5450f5bd-9c72-4390-a9c4-a7aba4edfdd2	Cosmos DB	Default Audit Allowed Audit, Deny, Disabled	0		GA	BuiltIn	true
Deploy Advanced Threat Protection for Cosmos DB Accounts	b5f04e03-92a3-4b09-9410-2cc5e5047656	Cosmos DB	Default DeployIfNotExists Allowed DeployIfNotExists, Disabled	1	Security Admin	GA	BuiltIn	true

Roles used

Total Roles usage: 4
Total Roles unique usage: 3

Role	Role Id	#Policies	Policies
Contributor	b24988ac-6180-42a0-ab88-20f7382dd24c	1	Configure CosmosDB accounts to disable public network access
Security Admin	fb1c8493-542b-48eb-b624-b4c8fea62acd	1	Deploy Advanced Threat Protection for Cosmos DB Accounts
DocumentDB Account Contributor	5bd9cd88-fe45-4216-938b-f97437e15450	2	Configure Cosmos DB database accounts to disable local authentication, Configure CosmosDB accounts to disable public network access

History

none

JSON compare

n/a

JSON

EPAC