Cosmos DB accounts should use private link
Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to your CosmosDB account, data leakage risks are reduced.
By mapping private endpoints to your CosmosDB account, data leakage risks are reduced. Without private endpoints, access may use public endpoints or broad IP rules, enabling: interception and credential replay, unauthorized queries and data exfiltration, lateral movement via exposed paths.
What this control checks
Cosmos DB accounts should be reachable through Azure Private Link
Common pitfalls
Only Approved connections count
Azure Policy audits Microsoft.DocumentDB/databaseAccounts when the count of privateEndpointConnections with privateLinkServiceConnectionState.status equal to Approved is less than 1.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "CosmosDB accounts should use private link" (58440f8a-10c5-4151-bdce-dfbaad4a20b7); Prowler check cosmosdb_account_use_private_endpoints (prowler azure --checks cosmosdb_account_use_private_endpoints); PowerPipe control azure_compliance.control.cosmosdb_account_uses_private_link.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...) and 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;).
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 11 Access control
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
3 more clauses
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 2.2.2.1 Ensure Private Endpoints are used to access {service}
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 4.5.2 Ensure That Private Endpoints Are Used Where Possible
- 4.5.2 Ensure That Private Endpoints Are Used Where Possible
- 4.5.2 Ensure That Private Endpoints Are Used Where Possible
- 5.4.2 Ensure That Private Endpoints Are Used Where Possible
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
3 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- AC-4 Information Flow Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cosmosdb_account_uses_private_link - Powerpipe Control:
azure_compliance.control.cosmosdb_account_uses_private_link - Prowler Check:
cosmosdb_account_use_private_endpoints - Azure Policy Definition:
58440f8a-10c5-4151-bdce-dfbaad4a20b7
Last reviewed: 2026-10-11