Back to Checks
azure

Cosmos DB account has automatic failover enabled

cosmosdb_account_automatic_failover_enabled
Service: cosmosdbSeverity: medium
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:microsoft.documentdb/databaseaccounts

Azure Cosmos DB accounts are evaluated for automatic failover configuration. When enabled, Cosmos DB automatically promotes a secondary region to primary during a regional outage, ensuring continuous availability without manual intervention.

Prowler logoProwlerprowler-provider-azure

Risk

Without automatic failover, a regional outage requires manual failover which delays recovery and risks data unavailability. Applications dependent on the primary region experience downtime until an operator intervenes.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks cosmosdb_account_automatic_failover_enabled

Recommendation

Enable automatic failover on Cosmos DB accounts with multi-region deployments so a secondary region is promoted automatically when the primary region becomes unavailable. Configure failover priorities to reflect your recovery strategy, validate RTO/RPO expectations with periodic failover drills, and combine with multi-region writes where active-active is required.

Remediation

CLI

az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --enable-automatic-failover true

Terraform

# Terraform: Enable automatic failover on a Cosmos DB account
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<primary_region>"
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  geo_location {
    location          = "<primary_region>"
    failover_priority = 0
  }

  geo_location {
    location          = "<secondary_region>"
    failover_priority = 1
  }

  enable_automatic_failover = true # Critical: Promotes a secondary region during a primary region outage
}

NativeIaC

// Bicep: Enable automatic failover on a Cosmos DB account
resource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'GlobalDocumentDB'
  properties: {
    databaseAccountOfferType: 'Standard'
    locations: [
      { locationName: '<primary_region>', failoverPriority: 0 }
      { locationName: '<secondary_region>', failoverPriority: 1 }
    ]
    enableAutomaticFailover: true // Critical: Promotes a secondary region during a primary region outage
  }
}

Other

1Sign in to the Azure portal and open your Cosmos DB account
2In the left menu, select Replicate data globally
3Click Automatic Failover
4Toggle Enable Automatic Failover to On
5Set failover priorities for each region
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client


class cosmosdb_account_automatic_failover_enabled(Check):
    """Ensure that Cosmos DB accounts have automatic failover enabled."""

    def execute(self) -> Check_Report_Azure:
        """Execute the Cosmos DB automatic failover check.

        Iterates over every Cosmos DB account fetched by the service and reports
        PASS when `enableAutomaticFailover` is True, FAIL otherwise.

        Returns:
            A list of Check_Report_Azure with one report per Cosmos DB account.
        """
        findings = []
        for subscription, accounts in cosmosdb_client.accounts.items():
            for account in accounts:
                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not have automatic failover enabled."
                if account.enable_automatic_failover:
                    report.status = "PASS"
                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has automatic failover enabled."
                findings.append(report)

        return findings

References