> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit cosmosdb restrict default network access remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Restrict Default Network Access for Azure Cosmos DB Accounts" in Azure using the Azure console, follow these steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).

        2. Navigate to the Azure Cosmos DB account for which you want to restrict network access.

        3. Click on the "Firewalls and virtual networks" tab.

        4. Under the "Firewall" section, select "Enabled".

        5. Under the "Virtual networks" section, select the virtual network that you want to allow access to.

        6. Under the "Subnets" section, select the subnet that you want to allow access to.

        7. Click on "Save" to apply the changes.

        By following these steps, you have successfully remediated the misconfiguration "Restrict Default Network Access for Azure Cosmos DB Accounts" in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Restrict Default Network Access for Azure Cosmos DB Accounts" in Azure using Azure CLI, follow the below steps:

        1. Open the Azure CLI on your local machine or use the Azure Cloud Shell.
        2. Login to your Azure account using the command `az login`.
        3. Once logged in, select the subscription you want to work with using the command `az account set --subscription <subscription_id>`.
        4. Get the list of Cosmos DB accounts in the selected subscription using the command `az cosmosdb list`.
        5. Choose the Cosmos DB account for which you want to restrict default network access.
        6. Run the following command to update the Cosmos DB account settings to restrict default network access:

        ```
        az cosmosdb update \
            --name <cosmos_db_account_name> \
            --resource-group <resource_group_name> \
            --default-consistency-level <consistency_level> \
            --disable-key-based-metadata-write-access true \
            --enable-automatic-failover true \
            --enable-multiple-write-locations true \
            --locations regionName=<region_name> isZoneRedundant=False \
            --max-interval 10 \
            --max-staleness-prefix 200 \
            --max-staleness-seconds 300 \
            --network-acl-bypass AzureServices \
            --network-acl-bypass-resource-ids /subscriptions/<subscription_id>/resourceGroups/Microsoft.Network/providers/Microsoft.Network/virtualNetworks/default \
            --virtual-network-rule "" \
            --ip-range-filter "" \
            --public-network-access Disabled
        ```

        Note: Replace the placeholders `<cosmos_db_account_name>`, `<resource_group_name>`, `<consistency_level>`, `<region_name>`, and `<subscription_id>` with the actual values.

        7. Once the command is executed successfully, the default network access for the Cosmos DB account will be restricted.

        This will remediate the misconfiguration "Restrict Default Network Access for Azure Cosmos DB Accounts" in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To restrict default network access for Azure Cosmos DB Accounts using Python, you can follow these steps:

        1. Import the necessary modules:

        ```python theme={null}
        from azure.cosmos import CosmosClient
        from azure.cosmos.errors import CosmosHttpResponseError
        ```

        2. Create a Cosmos DB client instance:

        ```python theme={null}
        endpoint = "your_cosmos_db_account_endpoint"
        key = "your_cosmos_db_account_key"
        client = CosmosClient(endpoint, key)
        ```

        3. Get the Cosmos DB account properties:

        ```python theme={null}
        try:
            properties = client.ReadAccount()
        except CosmosHttpResponseError as e:
            print(e)
            sys.exit(1)
        ```

        4. Check if default network access is enabled:

        ```python theme={null}
        if properties["enableMultipleWriteLocations"]:
            print("Default network access is enabled.")
        else:
            print("Default network access is disabled.")
            sys.exit(0)
        ```

        5. Disable default network access:

        ```python theme={null}
        properties["enableMultipleWriteLocations"] = False
        try:
            client.UpdateAccount(properties)
            print("Default network access has been disabled.")
        except CosmosHttpResponseError as e:
            print(e)
            sys.exit(1)
        ```

        The complete code will look like this:

        ```python theme={null}
        from azure.cosmos import CosmosClient
        from azure.cosmos.errors import CosmosHttpResponseError

        endpoint = "your_cosmos_db_account_endpoint"
        key = "your_cosmos_db_account_key"
        client = CosmosClient(endpoint, key)

        try:
            properties = client.ReadAccount()
        except CosmosHttpResponseError as e:
            print(e)
            sys.exit(1)

        if properties["enableMultipleWriteLocations"]:
            print("Default network access is enabled.")
        else:
            print("Default network access is disabled.")
            sys.exit(0)

        properties["enableMultipleWriteLocations"] = False
        try:
            client.UpdateAccount(properties)
            print("Default network access has been disabled.")
        except CosmosHttpResponseError as e:
            print(e)
            sys.exit(1)
        ```

        Note: Replace "your\_cosmos\_db\_account\_endpoint" and "your\_cosmos\_db\_account\_key" with the actual values of your Cosmos DB account.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_mssql_server" "this" {
          name                         = "SQL_SERVER_NAME"              # substitute with your SQL Server name
          resource_group_name          = azurerm_resource_group.this.name
          location                     = azurerm_resource_group.this.location

          version                      = "12.0"
          administrator_login          = "SQL_ADMIN_USERNAME"           # substitute with your admin username
          administrator_login_password = "SQL_ADMIN_PASSWORD"           # substitute with your admin password

          // Deny access from all public networks (including Internet)
          public_network_access_enabled = false
        }
        ```

        If you need connectivity after this change, configure a private endpoint (`azurerm_private_endpoint`) for the server in a secure virtual network.

        Verification: `terraform plan` should show an update to the existing `azurerm_mssql_server` setting `public_network_access_enabled` changing from `true` (or `null`) to `false`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>