turbot/steampipe-mod-azure-perimeter

Control: Cosmos DB accounts should restrict public network access

Description

Azure Cosmos DB accounts should be configured to restrict public network access through virtual network rules.

Usage

Run the control in your terminal:

powerpipe control run azure_perimeter.control.cosmos_db_account_restrict_public_network_access

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_perimeter.control.cosmos_db_account_restrict_public_network_access --share

Steampipe Tables

SQL

select
c.id as resource,
case
when public_network_access = 'Disabled' then 'ok'
else 'alarm'
end as status,
case
when public_network_access = 'Disabled' then c.name || ' has public network access disabled.'
else c.name || ' has public network access enabled.'
end as reason
, c.resource_group as resource_group
, sub.display_name as subscription
from
azure_cosmosdb_account c,
azure_subscription sub
where
sub.subscription_id = c.subscription_id;

Tags