cosmosdb-security

Azure Cosmos DB Security

Security best practices for Azure Cosmos DB accounts, covering authentication, network isolation, access control, and data protection.

When to Apply

Reference these guidelines when:

• Setting up authentication for Cosmos DB
• Configuring network access restrictions
• Assigning RBAC roles for data plane access
• Enabling continuous backup
• Hardening a Cosmos DB account for production

Rules

• security-disable-local-auth - Disable local authentication (keys)
• security-managed-identity - Use managed identity with DefaultAzureCredential
• security-network-restrict - Restrict network access
• security-rbac-least-privilege - Assign minimum RBAC roles
• security-continuous-backup - Enable continuous backup for PITR

Full Compiled Document

For all rules expanded: AGENTS.md