azure-cosmosdb-azure-only-firewall
Cosmos DB account with firewall restricted to 0.0.0.0 (all Azure IPs) - accessible from any Azure-hosted workload but not the open internet.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
[{'account': None}]
where
node_class(?account) == Data and node_type(?account) ==
NoSQLDatabase
node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
?account.properties.publicNetworkAccess != 'Disabled'
?account.properties.ipRules contains ONLY '0.0.0.0'
?account.properties.virtualNetworkRules is empty or null
emit
| source type | NoSQLDatabase |
|---|---|
| target type | Tenant |
| source | ?account |
| target | <azure tenant hosting the account> |
| state logic | if ?account.properties.ipRules is confirmed to contain only '0.0.0.0': ACTIVE (all Azure-hosted principals can reach the endpoint). |
Narrative
{account.name} has a firewall rule allowing all Azure datacenter IPs (0.0.0.0). Any workload running in Azure - whether in the same subscription or a different one - can reach the Cosmos DB data-plane endpoint. With a valid credential (master key or Entra token), any Azure-hosted attacker can access the database.
Raw rule rules/derived/azure/cosmosdb.yaml
id: azure-cosmosdb-azure-only-firewall
emits: ExposedToTenant
description: "Cosmos DB account with firewall restricted to 0.0.0.0 (all Azure IPs) \u2014 accessible\
\ from any Azure-hosted workload but not the open internet."
match:
- - account: null
where:
- node_class(?account) == Data and node_type(?account) == NoSQLDatabase
- node_type(?account) matched provider_type == 'Microsoft.DocumentDB/databaseAccounts'
- ?account.properties.publicNetworkAccess != 'Disabled'
- ?account.properties.ipRules contains ONLY '0.0.0.0'
- ?account.properties.virtualNetworkRules is empty or null
emit:
source_type: NoSQLDatabase
target_type: Tenant
source: ?account
target: <azure tenant hosting the account>
permissions: []
conditions: []
state_logic: 'if ?account.properties.ipRules is confirmed to contain only ''0.0.0.0'': ACTIVE (all Azure-hosted
principals can reach the endpoint).'
confidence: '0.90'
derived_from:
- <ipRules property record containing 0.0.0.0>
false_positive_note: "The '0.0.0.0' firewall rule in Cosmos DB means \"all Azure datacenter IPs\" \u2014\
\ it allows any Azure-hosted workload to reach the endpoint, but external internet traffic is blocked.\
\ This is broader than a VNet-scoped rule but narrower than true internet exposure. Emit ExposedToTenant\
\ to model the broad but Azure-bounded blast radius. Do not emit ExposedToInternet for this case.\
\ An attacker still needs a valid credential (key or Entra token), but the network path is open from\
\ any Azure-hosted principal in the tenant."
narrative: "{account.name} has a firewall rule allowing all Azure datacenter IPs (0.0.0.0). Any workload\
\ running in Azure \u2014 whether in the same subscription or a different one \u2014 can reach the\
\ Cosmos DB data-plane endpoint. With a valid credential (master key or Entra token), any Azure-hosted\
\ attacker can access the database."