Security best practices for Azure Cosmos DB accounts, covering authentication, network isolation, access control, and data protection.
When to Apply
Reference these guidelines when:
- Setting up authentication for Cosmos DB
- Configuring network access restrictions
- Assigning RBAC roles for data plane access
- Enabling continuous backup
- Hardening a Cosmos DB account for production
Rules
- security-disable-local-auth - Disable local authentication (keys)
- security-managed-identity - Use managed identity with DefaultAzureCredential
- security-network-restrict - Restrict network access
- security-rbac-least-privilege - Assign minimum RBAC roles
- security-continuous-backup - Enable continuous backup for PITR
Full Compiled Document
For all rules expanded: AGENTS.md