Azure Cosmos DB accounts should have firewall rules

Verifies that Azure Cosmos DB accounts have defined firewall rules to prevent traffic from unauthorized sources. Accounts that have at least one `IP` rule defined with the `virtual network filter` enabled are deemed compliant.

Access from all networks enlarges the attack surface. If keys or tokens are exposed or privileges are misconfigured, attackers anywhere can read or modify data, harming confidentiality and integrity.

What this control checks

Checks Azure Cosmos DB accounts for firewall rules

Common pitfalls

Compliant with an IP rule or public access off

Accounts that have at least one IP rule defined with the virtual network filter enabled are deemed compliant. Accounts disabling public access are also deemed compliant.

Avoid 0.0.0.0 in IP allowlists

Keep IP allowlists minimal and avoid 0.0.0.0.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Cosmos DB accounts should have firewall rules" (862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb); Prowler check cosmosdb_account_firewall_use_selected_networks (prowler azure --checks cosmosdb_account_firewall_use_selected_networks); PowerPipe controls azure_compliance.control.cosmosdb_account_virtual_network_filter_enabled and azure_compliance.control.cosmosdb_account_with_firewall_rules.

Scans of the Terraform code that flag the same setting before deployment: Checkov checks CKV_AZURE_101 and CKV_AZURE_99.

Framework-specific interpretation

ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security), A.8.21 (Security of Network Services) and A.8.22 (Segregation of Networks).

NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;) and 6.7.2.b (determine and apply controls to protect the relevant entities internal network domains from unauthorised access;).

NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).

FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).

Framework mappings

The clauses this control is mapped to in each framework.

ISO/IEC 27001:2022

A.8.20 Network security
A.8.21 Security of network services
A.8.22 Segregation of networks

NIS2 Directive (EU 2022/2555)

2 Risk management policy
6 Security in network and information systems acquisition, development and maintenance
11 Access control

NIST SP 800-53 Rev 5

Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

AC-4 Information Flow Enforcement
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.3 Control the flow of CUI in accordance with approved authorizations
3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

RBI Cyber Security Framework for UCBs

Annex I (1.3)

RBI IT Framework for NBFCs

5 Policy for Information System Audit (IS Audit)

BSI C5:2025

COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.

CIS Azure Benchmark v2.0.0

4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks

CIS Azure Benchmark v2.1.0

4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks

CIS Azure Benchmark v3.0.0

5.4.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks

CMMC 2.0 Level 2

AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)

FedRAMP High

AC-4 Information Flow Enforcement
SC-7 Boundary Protection
SC-7(3) Access Points

HIPAA Security Rule 2003

164.308(a)(1)(ii)(B) Risk management
164.312(a)(1) Access control

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: cosmosdb_account_with_firewall_rules
Checkov Checks: CKV_AZURE_101, CKV_AZURE_99
Powerpipe Controls: azure_compliance.control.cosmosdb_account_virtual_network_filter_enabled, azure_compliance.control.cosmosdb_account_with_firewall_rules
Prowler Check: cosmosdb_account_firewall_use_selected_networks
Azure Policy Definition: 862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb

Last reviewed: 2026-10-11

View all Azure controls →