Back to Checks
azure

Cosmos DB account firewall allows access only from selected networks

cosmosdb_account_firewall_use_selected_networks
Service: cosmosdbSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:microsoft.documentdb/databaseaccounts

Azure Cosmos DB accounts limit connectivity to selected networks using virtual network rules and/or IP allowlists rather than permitting access from all networks.

The evaluation determines whether the account's network firewall enforces this restriction.

Prowler logoProwlerprowler-provider-azure

Risk

Access from all networks enlarges the attack surface. If keys or tokens are exposed or privileges are misconfigured, attackers anywhere can read or modify data, harming confidentiality and integrity.

Weak segmentation also enables SSRF/pivot paths from Azure services and can impact availability through abuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks cosmosdb_account_firewall_use_selected_networks

Recommendation

Set network access to Selected networks with least privilege:

  • Prefer private endpoints or VNet service endpoints with subnet ACLs
  • Keep IP allowlists minimal; avoid 0.0.0.0
  • When feasible, set publicNetworkAccess=Disabled with Private Link
  • Apply defense in depth and monitor access and firewall changes

Remediation

CLI

az cosmosdb network-rule add -g <RESOURCE_GROUP> -n <ACCOUNT_NAME> --subnet <example_resource_id>

Terraform

# Enable Cosmos DB VNet firewall and allow a specific subnet
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = azurerm_resource_group.<example_resource_name>.location
  resource_group_name = azurerm_resource_group.<example_resource_name>.name
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  consistency_policy { consistency_level = "Session" }
  geo_location { location = azurerm_resource_group.<example_resource_name>.location failover_priority = 0 }

  is_virtual_network_filter_enabled = true  # CRITICAL: Enforces selected networks only
  virtual_network_rule {
    id = "<example_resource_id>"           # CRITICAL: Subnet resource ID allowed to access the account
  }
}

NativeIaC

// Enable selected networks only by turning on VNet filter and adding one allowed subnet
resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
  name: '<example_resource_name>'
  location: '<LOCATION>'
  properties: {
    databaseAccountOfferType: 'Standard'
    locations: [{ locationName: '<LOCATION>'; failoverPriority: 0 }]
    isVirtualNetworkFilterEnabled: true // CRITICAL: Enables VNet firewall (selected networks only)
    virtualNetworkRules: [
      {
        id: '<example_resource_id>' // CRITICAL: Subnet resource ID allowed to access the account
      }
    ]
  }
}

Other

1In Azure Portal, open your Cosmos DB account
2Go to Settings > Networking
3Select Selected networks
4Click Add existing virtual network, choose the VNet and Subnet, then click Enable and Add
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client


class cosmosdb_account_firewall_use_selected_networks(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, accounts in cosmosdb_client.accounts.items():
            subscription_name = cosmosdb_client.subscriptions.get(
                subscription, subscription
            )
            for account in accounts:
                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription_name} ({subscription}) has firewall rules that allow access from all networks."
                if account.is_virtual_network_filter_enabled:
                    report.status = "PASS"
                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription_name} ({subscription}) has firewall rules that allow access only from selected networks."
                findings.append(report)

        return findings

References