Policy Packs

guardrails-samples

Ensure that only trusted and authorized networks can access the database, reducing the risk of unauthorized access, data breaches, and ensuring compliance.

Enforce Azure Cosmos DB Database Accounts Are Accessible to Selected Networks

main

azure_cosmosdb_database_account_firewall

Configure the firewall settings required for `Azure &gt; Cosmos DB &gt; Database Account`.&#92;n&#92;nAzure Cosmos DB provides a layered security model. It enables you to secure and control the level of access to your database accounts that your applications and enterprise environments demand, based on the type and subset of networks used.&#92;n

databaseAccountFirewall

Azure > Cosmos DB > Database Account > Firewall

azure_cosmosdb_database_account_firewall_ip_ranges_required

Configure database accounts to allow access from specific public internet IP address ranges. This policy grants access to approved internet address ranges or individual IP addresses and blocks unapproved internet traffic.&#92;n&#92;nIf set to `Enforce: Required &gt; Items`, this policy will grant access to the IP ranges in Required &gt; Items.&#92;n

databaseAccountFirewallIpRangesRequired

Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required

azure_cosmosdb_database_account_firewall_ip_ranges_required_items

Configure database accounts to allow access from specific public internet IP address ranges. This configuration grants access to specific internet-based services and on-premises networks and blocks general internet traffic.&#92;n&#92;nProvide allowed internet address ranges using CIDR notation in the form 16.17.18.0/24 or as individual IP addresses like 16.17.18.19.&#92;n&#92;nSmall address ranges using &quot;/31&quot; or &quot;/32&quot; prefix sizes are not supported. These ranges should be configured using individual IP address rules.&#92;n&#92;nIP network rules are only allowed for public internet IP addresses. IP address ranges reserved for private networks (as defined in RFC 1918) aren&#39;t allowed in IP rules. Private networks include addresses that start with 10.*, 172.16.* - 172.31.*, and 192.168.*.&#92;n&#92;nExample:&#92;n  - ipAddressOrRange: 45.127.45.223&#92;n  - ipAddressOrRange: 223.235.113.55&#92;n  - ipAddressOrRange: 45.64.0.0/10&#92;n

databaseAccountFirewallIpRangesRequiredItems

Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Items

azure_cosmosdb_database_account_firewall_virtual_networks_required

Configure database accounts to allow access from specific virtual networks. This policy grants access to approved virtual networks and blocks unapproved internet traffic.&#92;n&#92;nIf set to `Enforce: Required &gt; Items`, this policy will grant access to the subnets in Required &gt; Items.&#92;n

databaseAccountFirewallVirtualNetworksRequired

Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required

azure_cosmosdb_database_account_firewall_virtual_networks_required_items

Configure database accounts to allow access only from specific subnets. The allowed subnets may belong to a virtual network in the same subscription, or those in a different subscription, including subscriptions belonging to a different Azure Active Directory tenant. This policy grants access to approved virtual networks.&#92;n

databaseAccountFirewallVirtualNetworksRequiredItems

Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required > Items

turbot_policy_setting.azure_cosmosdb_database_account_firewall

turbot_policy_setting.azure_cosmosdb_database_account_firewall_ip_ranges_required

turbot_policy_setting.azure_cosmosdb_database_account_firewall_ip_ranges_required_items

turbot_policy_setting.azure_cosmosdb_database_account_firewall_virtual_networks_required

turbot_policy_setting.azure_cosmosdb_database_account_firewall_virtual_networks_required_items

Policy	Setting	Note
Azure > Cosmos DB > Database Account > Firewall	Check: Allow only approved virtual networks and IP ranges
Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required	Check: Required > Items
Azure > Cosmos DB > Database Account > Firewall > IP Ranges > Required > Items	- "45.127.45.223" - "45.127.45.221"
Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required	Check: Required > Items
Azure > Cosmos DB > Database Account > Firewall > Virtual Networks > Required > Items	- "/subscriptions/1234ae5d-678b-901d-2f34-56b7890fc1c2/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVirtualNetwork/subnets/mySubnet"

Policy Settings