Microsoft recently released some recommendations for securing Azure Cosmos DB accounts.
Microsoft presented several recommendations, including regenerating Cosmos DB keys, using a combination of firewall rules, vNet and/or Azure Private Link for all Azure Cosmos DB customers. They also recommended using Role-Based Access Control that allows per user and security principal access control to Azure Cosmos DB and, finally, implementing regularly scheduled key changes in case users cannot use Role-Based Access Control.
The warning became needed after a bug known as Chaos DB affected Microsoft Azure Cosmos DB.
The bug granted attackers full admin rights to user data without authorization and allowed users to steal their customers’ primary read-write keys, giving them the power to remotely take over their databases.
In addition to the various recommendations, Microsoft also added additional security measures to prevent future attempts to gain access to its customers’ Cosmos DB accounts without authorization.
For more information, read the original story in Bleeping Computer.