Skip to content

Azure Cosmos MongoDB

Service Name: Azure Cosmos DB

Service Description: Azure Cosmos DB is Microsoft's globally distributed, multi-model database service for operational and analytics workloads. It offers multiple APIs including MongoDB, which allows developers to use MongoDB client drivers and tools with Azure Cosmos DB.

Service Address: https://azure.microsoft.com/en-us/services/cosmos-db/

Cosmos MongoDB

COSMOS_MONGODB

  • Validation Type: API Auth
  • IP Allow list: Does not exist
  • Secret Access Scope: Grants access to MongoDB-compatible databases hosted on Azure Cosmos DB.
  • Secret Revokement URL: https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-manage-database-account#regenerate-access-keys
  • Secret Example: mongodb://username:password@cosmosdb- mongodb.documents.azure.com:10255/?ssl=true&replicaSet=globaldb

Suspicious Activity Investigation Instructions:

  • Review Azure Activity Logs for unauthorized access or unusual query patterns
  • Check for unexpected data modifications or schema changes
  • Monitor for unusual traffic patterns or access from unfamiliar IP addresses
  • Review resource utilization for unexpected spikes that might indicate abuse
  • Check for unauthorized database or collection creation

Mitigation Instructions:

  • Immediately regenerate the connection string in the Azure Portal
  • Navigate to your Azure Cosmos DB account in the Azure Portal
  • Select "Connection String" from the left menu
  • Click "Regenerate Primary Key" or "Regenerate Secondary Key" as appropriate
  • Update all legitimate applications with the new connection string
  • Review and update IP firewall rules to restrict access
  • Enable Azure Defender for Cosmos DB for enhanced security monitoring