Control: 4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks
Description
Limiting your Cosmos DB to only communicate on whitelisted networks lowers its attack footprint.
Selecting certain networks for your Cosmos DB to communicate restricts the number of networks including the internet that can interact with what is stored within the database.
Remediation
From Azure Portal
- Open the portal menu.
- Select the Azure Cosmos DB blade
- Select the subscription you wish to audit.
- In the portal menu column select 'Firewalls and virtual networks'.
- Select the Database you wish to audit.
- Select 'Firewall and virtual networks'
- Change the radio button for 'allow access from' is to 'selected networks'
- Under the heading 'Virtual Networks' choose '+ Add existing virtual network' or '+ Add a new virtual network'.
- For existing networks, select the subscription, virtual network, and subnet, then select 'Add'. For new networks follow similar steps but enter the configuration you desire
Default Value
By default, Cosmos DBs are set to have access all networks.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v150_4_5_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v150_4_5_1 --shareSQL
This control uses a named query:
cosmosdb_account_virtual_network_filter_enabled