> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Automatic Failover

### More Info:

Ensure that your Microsoft Azure Cosmos DB accounts are using the Automatic Failover feature in order to enable resource replication and fault tolerance at the account level. Automatic failover allows Azure Cosmos DB to failover to the Azure cloud region with the highest failover priority when the source region become unavailable, without any additional action from the application or the user. The Cosmos DB account must have two or more regions configured in order to enable the feature.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of "Enable Automatic Failover" in Azure, please follow the below steps:

        1. Log in to the Azure portal at [https://portal.azure.com/](https://portal.azure.com/)
        2. Navigate to the Azure SQL database that you want to remediate.
        3. Click on "Failover Groups" in the left-hand menu.
        4. Click on "Add Failover Group."
        5. In the "Add Failover Group" blade, provide the following details:
           * Name: A unique name for the failover group.
           * Subscription: The subscription associated with the failover group.
           * Resource group: The resource group associated with the failover group.
           * Primary region: The region where the primary database is located.
           * Secondary region: The region where the secondary database is located.
        6. Click on "Create" to create the failover group.
        7. Once the failover group is created, click on it to open the "Failover Group" blade.
        8. In the "Failover Group" blade, click on "Add Secondary."
        9. In the "Add Secondary" blade, provide the following details:
           * Subscription: The subscription associated with the secondary database.
           * Server: The server where the secondary database is located.
           * Database: The name of the secondary database.
           * Auto-failover: Select the "On" option to enable automatic failover.
        10. Click on "Create" to add the secondary database to the failover group.

        Once you have completed these steps, automatic failover will be enabled for the Azure SQL database.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable automatic failover in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI command prompt.

        2. Log in to your Azure account using the command: `az login`

        3. Once you are logged in, select the desired subscription using the command: `az account set --subscription <subscription_id>`

        4. Enable automatic failover for the desired Azure SQL Database using the command:

           `az sql failover-group update --name <failover_group_name> --resource-group <resource_group_name> --partner-server <partner_server_name> --failover-policy Automatic`

           Replace the following parameters:

           * `<failover_group_name>`: The name of the failover group that you want to update.

           * `<resource_group_name>`: The name of the resource group that contains the failover group.

           * `<partner_server_name>`: The name of the partner server to which you want to fail over.

           * `Automatic`: This parameter specifies that the failover policy should be set to automatic.

        5. Verify that automatic failover has been enabled by checking the failover policy using the command:

           `az sql failover-group show --name <failover_group_name> --resource-group <resource_group_name>`

           This command will return the details of the failover group, including the failover policy.

        That's it! You have successfully enabled automatic failover for an Azure SQL Database using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of enabling automatic failover in Azure using Python, you can follow the below steps:

        1. Import the required libraries:

        ```python theme={null}
        from azure.mgmt.redis import RedisManagementClient
        from azure.common.credentials import ServicePrincipalCredentials
        ```

        2. Set the required credentials:

        ```python theme={null}
        TENANT_ID = '<your tenant id>'
        CLIENT_ID = '<your client id>'
        SECRET = '<your secret>'
        SUBSCRIPTION_ID = '<your subscription id>'

        credentials = ServicePrincipalCredentials(client_id=CLIENT_ID, secret=SECRET, tenant=TENANT_ID)
        redis_client = RedisManagementClient(credentials, SUBSCRIPTION_ID)
        ```

        3. Get the Redis cache instance:

        ```python theme={null}
        RESOURCE_GROUP_NAME = '<your resource group name>'
        CACHE_NAME = '<your cache name>'

        cache = redis_client.redis.get(RESOURCE_GROUP_NAME, CACHE_NAME)
        ```

        4. Update the Redis cache instance to enable automatic failover:

        ```python theme={null}
        cache.high_availability.is_azure_internal_automatic_failover_enabled = True
        redis_client.redis.create_or_update(RESOURCE_GROUP_NAME, CACHE_NAME, cache)
        ```

        This will enable automatic failover for the Redis cache instance in Azure.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_cosmosdb_account" "COSMOS_ACCOUNT" {
          name                = "COSMOS_ACCOUNT_NAME"          # substitute your Cosmos DB account name
          location            = "PRIMARY_REGION"               # e.g. "eastus"
          resource_group_name = azurerm_resource_group.RG.name # or your RG name
          offer_type          = "Standard"
          kind                = "GlobalDocumentDB"

          # This enables automatic regional failover
          automatic_failover_enabled = true

          # Primary write region (failover_priority = 0)
          geo_location {
            location          = "PRIMARY_REGION"   # e.g. "eastus"
            failover_priority = 0
          }

          # At least one additional region for automatic failover
          geo_location {
            location          = "SECONDARY_REGION" # e.g. "westus"
            failover_priority = 1
          }

          # ...other existing settings (consistency_policy, capabilities, backup, etc.)
        }
        ```

        Changing `automatic_failover_enabled` and adding secondary `geo_location` entries is an in-place update for the Cosmos DB account and should not force resource replacement, though Cosmos will perform online replication to the new region.

        To verify, `terraform plan` should show `automatic_failover_enabled` changing from `false` to `true` (or being added as `true`) and at least one new `geo_location` block with `failover_priority` ≥ 1 being created or updated.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>