Back to Checks
azure

Cosmos DB account has public network access disabled

cosmosdb_account_public_network_access_disabled
Service: cosmosdbSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.documentdb/databaseaccounts

Azure Cosmos DB accounts are evaluated for public network access. Disabling public network access ensures the account is only reachable through private endpoints or VNet service endpoints, reducing the attack surface and preventing direct exposure of the data plane to the internet.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing public network access exposes the Cosmos DB data plane to the internet. Combined with leaked connection strings, weak firewall rules, or compromised AAD tokens, this enables unauthorized data access, enumeration, brute force, and data exfiltration from any source on the internet.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks cosmosdb_account_public_network_access_disabled

Recommendation

Disable public network access on Cosmos DB accounts and require connectivity via private endpoints or VNet service endpoints. Before enforcement, validate that all application workloads have private-network connectivity, and pair this control with AAD/RBAC authentication, TLS 1.2+, and firewall rules restricted to the minimum trusted ranges to uphold defense in depth.

Remediation

CLI

az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --public-network-access Disabled

Terraform

# Terraform: Disable public network access on a Cosmos DB account
resource "azurerm_cosmosdb_account" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_location>"
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  geo_location {
    location          = "<example_location>"
    failover_priority = 0
  }

  public_network_access_enabled = false # Critical: Blocks all public-internet traffic to the data plane
}

NativeIaC

// Bicep: Disable public network access on a Cosmos DB account
resource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'GlobalDocumentDB'
  properties: {
    databaseAccountOfferType: 'Standard'
    locations: [{ locationName: resourceGroup().location }]
    publicNetworkAccess: 'Disabled' // Critical: Blocks all public-internet traffic to the data plane
  }
}

Other

1Sign in to the Azure portal and open your Cosmos DB account
2In the left menu, select Networking
3Under Public network access, select Disabled
4Configure private endpoints or VNet service endpoints before saving so clients retain connectivity
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client


class cosmosdb_account_public_network_access_disabled(Check):
    """Ensure that Cosmos DB accounts have public network access disabled."""

    def execute(self) -> Check_Report_Azure:
        """Execute the Cosmos DB public network access check.

        Iterates over every Cosmos DB account fetched by the service and reports
        PASS when `publicNetworkAccess` is `Disabled` or `SecuredByPerimeter`
        (Microsoft Network Security Perimeter), FAIL otherwise (including when
        the property is missing or set to `Enabled`).

        Returns:
            A list of Check_Report_Azure with one report per Cosmos DB account.
        """
        findings = []
        for subscription, accounts in cosmosdb_client.accounts.items():
            for account in accounts:
                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not have public network access disabled (current value: {account.public_network_access!r})."
                if account.public_network_access in {"Disabled", "SecuredByPerimeter"}:
                    report.status = "PASS"
                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has public network access disabled."
                findings.append(report)

        return findings

References