Skip to main content

πŸ›‘οΈ Azure Cosmos DB Account Private Endpoints are not used🟒

Stats​

not available

Logic​

Similar Policies​

  • Internal: dec-x-b4d3d9dc

Similar Internal Rules​

RulePoliciesFlags
βœ‰οΈ dec-x-b4d3d9dc2

Description​

Open File

Description​

Private endpoints limit network traffic to approved sources.

Rationale​

For sensitive data, private endpoints allow granular control of which services can communicate with Cosmos DB and ensure that this network traffic is private. You set this up on a case-by-case basis for each service you want to connect.

Impact​

Only approved services can communicate with Cosmos DB.

Audit​

From Azure Portal​
  1. Open the portal menu.
  2. Select the Azure Cosmos DB blade.
  3. Select the Azure Cosmos DB account.
  4. Select Networking.
  5. Ensure Public network access is set to Selected networks.
  6. Ensure the listed networks are set appropriately.
  7. Select Private access.
  8. Ensure a private endpoint exists and Connection state is Approved.
From Azure Policy​

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Open the portal menu.
  2. Select the Azure Cosmos DB blade.
  3. Select the Azure Cosmos DB account.
  4. Select Networking.
  5. Select Private access.
  6. Click + Private Endpoint.
  7. Provide a name.
  8. Click Next.
  9. From the Resource type drop-down, select Microsoft.AzureCosmosDB/databaseAccounts.
  10. From the Resource drop-down, select the Cosmos DB account.
  11. Click Next.
  12. Provide appropriate virtual network details.
  13. Click Next.
  14. Provide appropriate DNS details.
  15. Click Next.
  16. Optionally provide tags.
  17. Click Next, then select Review + create.
  18. Click Create.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
πŸ’Ό APRA CPG 234 β†’ πŸ’Ό 36f network design β€” to ensure authorised network traffic flows and to reduce the impact of security compromises;76107no data
πŸ’Ό APRA CPG 234 β†’ πŸ’Ό 45 An understanding of plausible worst case scenarios can help regulated entities identify and implement additional controls to prevent or reduce the impact of such scenarios. One example is malware that infects computers and encrypts data, both on the infected computer and any connected storage, including (corporate) networks and cloud storage. Such attacks reinforce the importance of protecting the backup environment in the event that the production environment is compromised. Common techniques to achieve this include network segmentation, highly restricted and segregated access controls and network traffic flow restrictions.83115no data
πŸ’Ό CIS Azure v2.1.0 β†’ πŸ’Ό 4.5.2 Ensure That Private Endpoints Are Used Where Possible - Level 2 (Automated)11no data
πŸ’Ό CIS Azure v3.0.0 β†’ πŸ’Ό 5.4.2 Ensure That Private Endpoints Are Used Where Possible (Automated)1no data
πŸ’Ό Cloudaware Framework β†’ πŸ’Ό Secure Access61no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό AC-3 Access Enforcement (L)(M)(H)49103no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό AC-4(21) Physical or Logical Separation of Information Flows (M)(H)18141no data
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό AC-3 Access Enforcement (L)(M)(H)103no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό AC-3 Access Enforcement (L)(M)(H)103no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό AC-4(21) Physical or Logical Separation of Information Flows (M)(H)141no data
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.1.2 Access to networks and network services2767no data
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.4.1 Information access restriction4992no data
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties48127no data
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.DS-5: Protections against data leaks are implemented89152no data
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.PT-3: The principle of least functionality is incorporated by configuring systems to provide only essential capabilities3179no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties199no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected248no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected219no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows83141no data
πŸ’Ό PCI DSS v3.2.1 β†’ πŸ’Ό 1.3 Prohibit direct public access between the Internet and any system component in the cardholder data environment.712113no data
πŸ’Ό PCI DSS v4.0.1 β†’ πŸ’Ό 1.4.1 NSCs are implemented between trusted and untrusted networks.90no data
πŸ’Ό PCI DSS v4.0 β†’ πŸ’Ό 1.4.1 NSCs are implemented between trusted and untrusted networks.3190no data
πŸ’Ό SOC 2 β†’ πŸ’Ό CC6.1-6 Manages Points of Access89no data
πŸ’Ό SOC 2 β†’ πŸ’Ό CC6.1-8 Manages Identification and Authentication2234no data
πŸ’Ό UK Cyber Essentials β†’ πŸ’Ό 1.2 Prevent access to the administrative interface from the internet85119no data