Azure Cosmos DB Security

Authentication and Authorization

Securing access to your Azure Cosmos DB data begins with robust authentication and authorization mechanisms. Azure Cosmos DB supports multiple methods:

• Primary/Secondary Keys: The simplest form of authentication, providing full access to the database account. Use with caution and consider alternatives for granular access.
• Resource Tokens: Ideal for granting time-bound, limited access to specific resources (like documents or attachments) to client applications without exposing master keys.
• Azure Active Directory (Azure AD) Integration: The recommended approach for enterprise environments. Azure AD enables role-based access control (RBAC), allowing you to assign specific permissions to users, groups, or service principals.

Role-Based Access Control (RBAC)

RBAC for Azure Cosmos DB allows you to define granular permissions. Built-in roles like "DocumentDB Account Reader" and "DocumentDB Contributor" are available, and you can also create custom roles for more specific needs.

Example of granting read access to a specific database:

# Using Azure CLI for RBAC assignment
az cosmosdb sql role assignment create --instance-role-definition-name "DocumentDB Account Reader" \
    --role-definition-id "your-role-definition-id" \
    --scope "/subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.DocumentDB/databaseAccounts/YOUR_COSMOS_DB_ACCOUNT/sqlDatabases/YOUR_DATABASE_NAME" \
    --assignee "user@example.com"
                

Data Encryption

Azure Cosmos DB encrypts all data automatically, both at rest and in transit, without requiring any configuration changes from the user.

Encryption at Rest

All data stored in Azure Cosmos DB is encrypted using AES-256. This includes data stored on the service's storage layer, backups, and temporary data. Key management is handled by Microsoft.

Bring Your Own Key (BYOK)

For enhanced control over your encryption keys, Azure Cosmos DB supports BYOK integration with Azure Key Vault. This allows you to manage the lifecycle of your encryption keys, including creation, rotation, and revocation.

Encryption in Transit

Connections to Azure Cosmos DB are secured using Transport Layer Security (TLS) 1.2 or higher. SDKs and the REST API automatically enforce TLS for all communications.

Network Security

Azure Cosmos DB provides several options to control network access to your database accounts, ensuring that your data is only accessible from authorized networks.

Firewall Support

You can configure IP-based firewall rules to restrict access to your Azure Cosmos DB account to specific IP addresses or ranges. This is essential for preventing unauthorized access from the public internet.

Virtual Network (VNet) Service Endpoints

Service endpoints allow you to secure your Azure Cosmos DB resources by binding them to a specific Azure Virtual Network. This ensures that traffic from your VNet to Cosmos DB is routed over the Azure backbone network, not the public internet.

Private Link

Azure Private Link provides private connectivity from your virtual network to Azure Cosmos DB, eliminating public internet exposure. All network traffic between your virtual network and Cosmos DB travels over the Azure backbone network.

Configuring Private Link:

• Create a Private Endpoint in your VNet.
• Associate the Private Endpoint with your Azure Cosmos DB account.
• Configure DNS resolution to point to the private IP address.

Auditing and Logging

Comprehensive auditing and logging are vital for security monitoring, compliance, and troubleshooting. Azure Cosmos DB integrates with Azure Monitor and Azure Activity Log.

Azure Monitor Integration

Collect and analyze telemetry data, including performance metrics and diagnostic logs, from Azure Cosmos DB. You can set up alerts for specific events or metrics.

Diagnostic Logs

Enable diagnostic logs to capture detailed information about operations performed on your Azure Cosmos DB account, such as read, write, and delete operations on data and resources. These logs can be sent to:

• Azure Storage for archiving.
• Azure Event Hubs for streaming to SIEM systems.
• Azure Log Analytics for analysis.

Example of enabling diagnostic settings:

# Using Azure PowerShell
$resource = Get-AzResource -ResourceId "/subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.DocumentDB/databaseAccounts/YOUR_COSMOS_DB_ACCOUNT"
Set-AzDiagnosticSetting -ResourceId $resource.ResourceId -WorkspaceId "/subscriptions/YOUR_SUBSCRIPTION_ID/resourceGroups/YOUR_RESOURCE_GROUP/providers/Microsoft.OperationalInsights/workspaces/YOUR_LOG_ANALYTICS_WORKSPACE" -Enabled $true -Category "DataRequests,Query,SystemFunction,ServiceInternal"
                

Threat Protection

Azure Cosmos DB is protected by Azure's robust security infrastructure, including features like DDoS protection and Microsoft's security intelligence.

Azure DDoS Protection

Azure DDoS Protection provides enhanced DDoS mitigation capabilities. When enabled, it offers protection against volumetric attacks, protocol attacks, and network layer attacks.

Microsoft Threat Intelligence

Azure leverages vast amounts of threat intelligence to identify and mitigate sophisticated attacks. This intelligence is applied across all Azure services, including Azure Cosmos DB.

Compliance

Azure Cosmos DB adheres to a wide range of international and industry-specific compliance standards, helping you meet your regulatory requirements.

Key compliance standards include:

• ISO 27001
• SOC 1, 2, and 3
• PCI DSS
• HIPAA/HITRUST
• GDPR
• FedRAMP

Refer to the Azure Compliance page for the most up-to-date information.