Cosmos DB account uses continuous backup policy
Azure Cosmos DB accounts are evaluated for continuous backup policy. Continuous backup provides point-in-time restore (PITR) enabling recovery to any point within the retention window, unlike periodic backup which only supports full restores at fixed intervals.
ProwlerRisk
Periodic backup limits recovery to the last backup snapshot. Data changes between snapshots are lost during restore. Continuous backup enables granular recovery from accidental deletes, corruption, or ransomware.
Run this check with Prowler
Run in Prowler Cloudprowler azure --checks cosmosdb_account_backup_policy_continuousRecommendation
Use Continuous backup for Cosmos DB accounts that require point-in-time restore (PITR). Pick the retention tier (Continuous7Days or Continuous30Days) based on recovery objectives, and validate restore procedures with periodic drills. Note that switching from Periodic to Continuous is a one-way migration; plan the change and review pricing before applying.
Remediation
CLI
az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --backup-policy-type Continuous --continuous-tier Continuous30DaysTerraform
# Terraform: Configure Cosmos DB account with Continuous backup (irreversible)
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
name = "<example_resource_name>"
resource_group_name = "<example_resource_name>"
location = "<example_resource_name>"
offer_type = "Standard"
kind = "GlobalDocumentDB"
geo_location {
location = "<example_resource_name>"
failover_priority = 0
}
backup {
type = "Continuous" # Critical: Enables point-in-time restore. One-way migration from Periodic.
tier = "Continuous30Days" # or "Continuous7Days" for the lower-cost tier
}
}NativeIaC
// Bicep: Switch a Cosmos DB account to Continuous backup (irreversible)
resource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
name: '<example_resource_name>'
location: resourceGroup().location
kind: 'GlobalDocumentDB'
properties: {
databaseAccountOfferType: 'Standard'
locations: [{ locationName: resourceGroup().location }]
backupPolicy: {
type: 'Continuous' // Critical: Enables point-in-time restore. Migration from Periodic is one-way.
continuousModeProperties: {
tier: 'Continuous30Days' // or 'Continuous7Days' for the lower-cost tier
}
}
}
}Other
Check Code
from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
class cosmosdb_account_backup_policy_continuous(Check):
"""Ensure that Cosmos DB accounts use the continuous backup policy."""
def execute(self) -> Check_Report_Azure:
"""Execute the Cosmos DB continuous-backup check.
Iterates over every Cosmos DB account fetched by the service and reports
PASS when `backupPolicy.type` is `Continuous`, FAIL otherwise (including
when the property is missing).
Returns:
A list of Check_Report_Azure with one report per Cosmos DB account.
"""
findings = []
for subscription, accounts in cosmosdb_client.accounts.items():
for account in accounts:
report = Check_Report_Azure(metadata=self.metadata(), resource=account)
report.subscription = subscription
report.status = "FAIL"
report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not use continuous backup policy."
if account.backup_policy_type == "Continuous":
report.status = "PASS"
report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} uses continuous backup policy."
findings.append(report)
return findings