🛡️ Azure Cosmos DB Account analytical storage uses periodic backup🟢

• Contextual name: 🛡️ Account analytical storage uses periodic backup🟢
• ID: /ce/ca/azure/cosmos-db/analytical-storage-periodic-backup
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: BEST_PRACTICE
• Policy Categories: COST

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Cosmos DB Account
  • 🔌 Azure Cosmos DB Account - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that Azure Cosmos DB accounts with analytical storage enabled use continuous backup instead of periodic backup. This configuration aligns the backup mode with analytical workloads and helps identify opportunities to reduce avoidable costs.

Rationale

Analytical storage supports large-scale analytical workloads, including Synapse Link and Fabric Mirroring scenarios. Continuous backup is the recommended backup mode for eligible workloads and can be more cost-effective than periodic backup. It also supports point-in-time restoration within the configured retention period.

Impact

Using periodic backup for an eligible analytical workload can result in avoidable backup costs and provides restoration only from scheduled backup copies. Changing from periodic to continuous backup is a one-way operation that can affect backup retention options, restore procedures, regional availability, and cost. Plan the change around the workload's operational and recovery requirements.

Audit

This policy flags an Azure Cosmos DB Account as INCOMPLIANT when both of the

... see more

Remediation

Open File

Remediation

This finding is a configuration review, not evidence that Synapse Link or Fabric Mirroring is active. Before migrating, confirm that the account and its API support continuous backup. Review workload eligibility, retention, restore requirements, regional availability, and pricing impact. Migration from periodic to continuous backup is irreversible.

From Azure Portal

1. Open the Azure Cosmos DB account.
2. Select Backup & Restore.
3. Select Continuous backup.
4. Choose the available continuous-backup retention option that meets the recovery requirement.
5. Review the irreversible-change warning, then confirm the migration.

From Azure CLI

az cosmosdb update \
  --name {{cosmosdb-account-name}} \
  --resource-group {{resource-group-name}} \
  --backup-policy-type Continuous

Verify the change:

az cosmosdb show \
  --name {{cosmosdb-account-name}} \
  --resource-group {{resource-group-name}} \
  --query "backupPolicy.type" \
  --output tsv

The command must return Continuous.

References

1. https://learn.microsoft.com/en-us/azure/cosmos-db/continuous-backup-restore-introduction

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Resource Optimization			37		no data