Control: 4.5.2 Ensure That Private Endpoints Are Used Where Possible
Description
Private endpoints limit network traffic to approved sources.
For sensitive data, private endpoints allow granular control of which services can communicate with Cosmos DB and ensure that this network traffic is private. You set this up on a case by case basis for each service you wish to be connected.
Remediation
From Azure Portal
- Open the portal menu.
- Select the Azure Cosmos DB blade
- Select the subscription you wish to audit.
- Select the Database you wish to add an endpoint to.
- Then in the portal menu column select the blade 'Private Endpoint Connections'.
- Click '+ Private Endpoint'
- Select which subscription and resource group you want the endpoint to be in. Name it as desired.
- Select which subscription the endpoint will be under, its resource type.
- Select which virtual network desired.
- Select the DNS servers the endpoint will contact.
- Tag as desired and create.
- Back in the Private Endpoints view, select the endpoint and associate it with the Cosmos DB.
- In the listing below confirm that the listed selected networks are set to the appropriate endpoints.
Default Value
By default Cosmos DB does not have private endpoints enabled and its traffic is public to the network.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v150_4_5_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v150_4_5_2 --shareSQL
This control uses a named query:
cosmosdb_account_uses_private_link