Back to Checks
azure

Cosmos DB account enforces TLS 1.2 or higher

cosmosdb_account_minimum_tls_version
Service: cosmosdbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.documentdb/databaseaccounts

Azure Cosmos DB accounts are evaluated for minimum TLS version. TLS 1.0 and 1.1 are deprecated and contain known weaknesses. Enforcing TLS 1.2 ensures all client connections negotiate modern, secure encryption protocols.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing TLS 1.0/1.1 exposes client connections to POODLE, BEAST, and other protocol downgrade attacks that can compromise the confidentiality and integrity of data in transit, and may enable credential interception via weakened cipher suites.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks cosmosdb_account_minimum_tls_version

Recommendation

Set the Cosmos DB account minimum TLS version to at least 1.2 to block legacy protocols (TLS 1.0/1.1) vulnerable to known downgrade and cipher attacks. Inventory and update client SDKs and drivers to support TLS 1.2 prior to enforcement, and pair this control with private endpoints, AAD/RBAC authentication, and handshake failure monitoring to identify outdated clients.

Remediation

CLI

az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --minimal-tls-version Tls12

Terraform

# Terraform: Enforce minimum TLS 1.2 on a Cosmos DB account
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_location>"
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  geo_location {
    location          = "<example_location>"
    failover_priority = 0
  }

  minimal_tls_version = "Tls12" # Critical: Rejects client connections negotiating TLS 1.0 or 1.1
}

NativeIaC

// Bicep: Enforce minimum TLS 1.2 on a Cosmos DB account
resource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'GlobalDocumentDB'
  properties: {
    databaseAccountOfferType: 'Standard'
    locations: [{ locationName: resourceGroup().location }]
    minimalTlsVersion: 'Tls12' // Critical: Rejects client connections negotiating TLS 1.0 or 1.1
  }
}

Other

1Sign in to the Azure portal and open your Cosmos DB account
2In the left menu, select Networking
3Locate the Minimum TLS version setting
4Select TLS 1.2
5Click Save
6Validate that all client applications support TLS 1.2 before enforcing the change

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client


class cosmosdb_account_minimum_tls_version(Check):
    """Ensure that Cosmos DB accounts enforce TLS 1.2 or higher."""

    def execute(self) -> Check_Report_Azure:
        """Execute the Cosmos DB minimum TLS version check.

        Iterates over every Cosmos DB account fetched by the service and reports
        PASS when `minimalTlsVersion` is `Tls12` or higher, FAIL otherwise
        (including when the property is missing or set to a legacy value).

        Returns:
            A list of Check_Report_Azure with one report per Cosmos DB account.
        """
        findings = []
        for subscription, accounts in cosmosdb_client.accounts.items():
            for account in accounts:
                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not enforce TLS 1.2 or higher."
                if account.minimal_tls_version in {"Tls12", "Tls13"}:
                    report.status = "PASS"
                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} enforces TLS 1.2 or higher."
                findings.append(report)

        return findings

References