Azure Audit Cosmosdb Enable Automatic Failover Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of "Enable Automatic Failover" in Azure, please follow the below steps:

Log in to the Azure portal at https://portal.azure.com/
Navigate to the Azure SQL database that you want to remediate.
Click on "Failover Groups" in the left-hand menu.
Click on "Add Failover Group."
In the "Add Failover Group" blade, provide the following details:
- Name: A unique name for the failover group.
- Subscription: The subscription associated with the failover group.
- Resource group: The resource group associated with the failover group.
- Primary region: The region where the primary database is located.
- Secondary region: The region where the secondary database is located.
Click on "Create" to create the failover group.
Once the failover group is created, click on it to open the "Failover Group" blade.
In the "Failover Group" blade, click on "Add Secondary."
In the "Add Secondary" blade, provide the following details:
- Subscription: The subscription associated with the secondary database.
- Server: The server where the secondary database is located.
- Database: The name of the secondary database.
- Auto-failover: Select the "On" option to enable automatic failover.
Click on "Create" to add the secondary database to the failover group.

Once you have completed these steps, automatic failover will be enabled for the Azure SQL database.

Using CLI

To enable automatic failover in Azure using Azure CLI, follow these steps:

Open the Azure CLI command prompt.
Log in to your Azure account using the command: az login
Once you are logged in, select the desired subscription using the command: az account set --subscription <subscription_id>
Enable automatic failover for the desired Azure SQL Database using the command:

az sql failover-group update --name <failover_group_name> --resource-group <resource_group_name> --partner-server <partner_server_name> --failover-policy Automatic

Replace the following parameters:
- <failover_group_name>: The name of the failover group that you want to update.
- <resource_group_name>: The name of the resource group that contains the failover group.
- <partner_server_name>: The name of the partner server to which you want to fail over.
- Automatic: This parameter specifies that the failover policy should be set to automatic.
Verify that automatic failover has been enabled by checking the failover policy using the command:

az sql failover-group show --name <failover_group_name> --resource-group <resource_group_name>

This command will return the details of the failover group, including the failover policy.

That's it! You have successfully enabled automatic failover for an Azure SQL Database using Azure CLI.

Using Python

To remediate the misconfiguration of enabling automatic failover in Azure using Python, you can follow the below steps:

Import the required libraries:

from azure.mgmt.redis import RedisManagementClient
from azure.common.credentials import ServicePrincipalCredentials

Set the required credentials:

TENANT_ID = '<your tenant id>'
CLIENT_ID = '<your client id>'
SECRET = '<your secret>'
SUBSCRIPTION_ID = '<your subscription id>'

credentials = ServicePrincipalCredentials(client_id=CLIENT_ID, secret=SECRET, tenant=TENANT_ID)
redis_client = RedisManagementClient(credentials, SUBSCRIPTION_ID)

Get the Redis cache instance:

RESOURCE_GROUP_NAME = '<your resource group name>'
CACHE_NAME = '<your cache name>'

cache = redis_client.redis.get(RESOURCE_GROUP_NAME, CACHE_NAME)

Update the Redis cache instance to enable automatic failover:

cache.high_availability.is_azure_internal_automatic_failover_enabled = True
redis_client.redis.create_or_update(RESOURCE_GROUP_NAME, CACHE_NAME, cache)

This will enable automatic failover for the Redis cache instance in Azure.

Using Terraform

resource "azurerm_cosmosdb_account" "COSMOS_ACCOUNT" {
  name                = "COSMOS_ACCOUNT_NAME"          # substitute your Cosmos DB account name
  location            = "PRIMARY_REGION"               # e.g. "eastus"
  resource_group_name = azurerm_resource_group.RG.name # or your RG name
  offer_type          = "Standard"
  kind                = "GlobalDocumentDB"

  # This enables automatic regional failover
  automatic_failover_enabled = true

  # Primary write region (failover_priority = 0)
  geo_location {
    location          = "PRIMARY_REGION"   # e.g. "eastus"
    failover_priority = 0
  }

  # At least one additional region for automatic failover
  geo_location {
    location          = "SECONDARY_REGION" # e.g. "westus"
    failover_priority = 1
  }

  # ...other existing settings (consistency_policy, capabilities, backup, etc.)
}

Changing automatic_failover_enabled and adding secondary geo_location entries is an in-place update for the Cosmos DB account and should not force resource replacement, though Cosmos will perform online replication to the new region.

To verify, terraform plan should show automatic_failover_enabled changing from false to true (or being added as true) and at least one new geo_location block with failover_priority ≥ 1 being created or updated.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation