Best practices for operating Azure Cosmos DB: throughput and scaling, global distribution and consistency, monitoring and diagnostics, and security hardening.
When to Apply
Reference these guidelines when provisioning throughput, configuring global distribution, setting up monitoring, or hardening security for Azure Cosmos DB.
Rules
Throughput & Scaling
- throughput-autoscale - Use Autoscale for Variable Workloads
- throughput-burst - Understand Burst Capacity
- throughput-container-vs-database - Choose Container vs Database Throughput
- throughput-right-size - Right-Size Provisioned Throughput
- throughput-serverless - Consider Serverless for Dev/Test
Global Distribution
- global-conflict-resolution - Implement Conflict Resolution
- global-consistency - Choose Appropriate Consistency Level
- global-failover - Configure Automatic Failover
- global-multi-region - Configure Multi-Region Writes
- global-read-regions - Add Read Regions Near Users
- global-zone-redundancy - Configure Zone Redundancy for High Availability
Monitoring & Diagnostics
- monitoring-azure-monitor - Integrate Azure Monitor
- monitoring-diagnostic-logs - Enable Diagnostic Logging
- monitoring-latency - Monitor P99 Latency
- monitoring-ru-consumption - Track RU Consumption
- monitoring-throttling - Alert on Throttling (429s)
Security
- security-continuous-backup - Enable Continuous Backup for Point-in-Time Restore
- security-disable-local-auth - Disable Local Authentication (Keys)
- security-managed-identity - Use Managed Identity with DefaultAzureCredential
- security-network-restrict - Restrict Network Access
- security-rbac-least-privilege - Assign Minimum RBAC Roles with Narrow Scope