Azure Cosmos DB Key
Service Name: Azure Cosmos DB
Service Description: Azure Cosmos DB is Microsoft's globally distributed, multi-model database service for managing data at planet-scale. It offers turnkey global distribution, elastic scaling of throughput and storage, single-digit millisecond latencies, and comprehensive SLAs.
Service Address: https://azure.microsoft.com/en-us/services/cosmos-db/
Validation Type: API Auth
IP Allow list: IP restrictions can be configured at the account level through Azure Cosmos DB firewall and virtual networks settings.
Secret Access Scope: Grants full administrative access to manage and access all data within a Cosmos DB account, including the ability to read, write, and delete databases, containers, and documents.
Secret Revokement URL: https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#remove-access
Secret Example: wsJXBcMvMEAiBZc8Ht6fvLkO1PzHDJRpQ7Cz15lVeQKQiYWtlSQNQAQwVFUrYuNwVAazKlIwEw==
Suspicious Activity Investigation Instructions:
- Review Azure Activity Logs for unusual operations on your Cosmos DB account
- Check Azure Monitor metrics for unexpected spikes in request units (RU) consumption
- Examine diagnostic logs for unauthorized access attempts or unusual query patterns
- Monitor for unexpected increases in data storage or throughput costs
- Review network access logs for connections from unfamiliar IP addresses
Mitigation Instructions:
- Immediately regenerate the Cosmos DB account keys through the Azure Portal
- Navigate to your Cosmos DB account > Settings > Keys
- Click "Regenerate Primary Key" or "Regenerate Secondary Key" as appropriate
- Update all legitimate applications with the new key
- Consider implementing Azure Active Directory authentication instead of key-based authentication.
- Enable advanced threat protection for your Cosmos DB account
- Configure IP firewall rules to restrict access to known IP addresses
- Implement virtual network service endpoints to limit access to specific virtual networks