Skip to content

Azure Cosmos Table Storage

Service Name: Microsoft Azure Cosmos DB

Service Description: Azure Cosmos DB is Microsoft's globally distributed, multi-model database service for operational and analytics workloads. It offers multiple data models including Table storage, which provides a NoSQL key-attribute store with a schemaless design.

Service Address: https://azure.microsoft.com/en-us/products/cosmos-db/

Cosmos Table Storage

COSMOS_TABLE_STORAGE

  • Validation Type: API Auth
  • IP Allow list: Does not exist
  • Secret Access Scope: Grants access to Azure Cosmos DB Table storage resources, allowing read/write operations on table data.
  • Secret Revokement URL: https://learn.microsoft.com/en-us/azure/cosmos-db/table/how-to-manage-account-keys
  • Secret Example: DefaultEndpointsProtocol=https;AccountName=mycosmosaccount;AccountKey=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789==;TableEnd point=https://mycosmosaccount.table.cosmos.azure.com:443/;

Suspicious Activity Investigation Instructions:

  • Review Azure Activity Logs for unauthorized access or unusual operations
  • Check for unexpected spikes in data access or modification operations
  • Monitor for changes in access patterns or unusual geographic access locations
  • Examine Azure Monitor logs for failed authentication attempts - Review Azure Security Center alerts related to the Cosmos DB account

Mitigation Instructions:

  • Immediately regenerate the account keys from the Azure Portal
  • Navigate to your Cosmos DB account in the Azure Portal
  • Select "Keys" from the left navigation menu
  • Click "Regenerate Primary Key" or "Regenerate Secondary Key" as appropriate
  • Update all applications using the old key with the newly generated key
  • Implement Azure Private Endpoints to restrict network access
  • Enable Azure Defender for Cosmos DB for enhanced security monitoring