Disable public network access on Cosmos DB

March 21, 2025 ยท View on GitHub

SYNOPSIS

Azure Cosmos DB should have public network access disabled.

DESCRIPTION

Disabling public network access improves security by ensuring that the resource isn't exposed on the public internet. You can control exposure of your resources by creating private endpoints instead.

RECOMMENDATION

Consider disabling public network access on Cosmos DB, using private endpoints to control connectivity for data plane operations.

EXAMPLES

Configure with Azure template

To deploy database accounts that pass this rule:

  • Set the properties.publicNetworkAccess property to Disabled.

For example:

{
  "type": "Microsoft.DocumentDB/databaseAccounts",
  "apiVersion": "2023-11-15",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "kind": "GlobalDocumentDB",
  "properties": {
    "publicNetworkAccess": "Disabled",
    "locations": [
      {
        "locationName": "[parameters('location')]",
        "failoverPriority": 0,
        "isZoneRedundant": true
      }
    ]
  }
}

Configure with Bicep

To deploy database accounts that pass this rule:

  • Set the properties.publicNetworkAccess property to Disabled.

For example:

resource account 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' = {
  name: name
  location: location
  kind: 'GlobalDocumentDB'
  properties: {
    publicNetworkAccess: 'Disabled'
    locations: [
      {
        locationName: location
        failoverPriority: 0
        isZoneRedundant: true
      }
    ]
  }
}