Skip to content

Azure Cosmos Cassandra

Service Name: Azure Cosmos DB Cassandra API

Service Description: Azure Cosmos DB Cassandra API is a NoSQL database service that provides compatibility with Apache Cassandra while offering the benefits of Azure Cosmos DB, including global distribution, elastic scalability, and guaranteed low latency.

Service Address: https://azure.microsoft.com/en-us/products/cosmos-db/

Validation Type: API Auth

IP Allow list: Does not exist

Secret Access Scope: Grants access to Azure Cosmos DB Cassandra API resources, including the ability to read, write, and manage data in Cassandra tables.

Secret Revokement URL: https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#remove-role-assignments

Secret Example: AccountEndpoint=mycosmosaccount.cassandra.cosmos.azure.com;AccountKey=s 7Gwe7AC8zNYyB9FnTPwHD8DHFiEirbDmG0ZOCwsXAXTlzQMHCwOGjIKv6nTSfam9Uu7zfBkL Ani8ACDbw==

Suspicious Activity Investigation Instructions:

  • Review Azure Activity Logs for unauthorized access or unusual operations
  • Check for unexpected spikes in data access or throughput consumption
  • Monitor for changes in database schema or table structures
  • Look for unauthorized IP addresses accessing the Cassandra API endpoint
  • Examine query patterns for potential data exfiltration attempts

Mitigation Instructions:

  • Immediately regenerate the account key in the Azure Portal
  • Navigate to your Cosmos DB account in the Azure Portal
  • Select "Keys" from the left navigation menu
  • Click "Regenerate" for the compromised key
  • Update applications with the new key
  • Consider implementing Azure RBAC for more granular access control
  • Enable advanced threat protection for the Cosmos DB account
  • Review and restrict network access using firewall rules