Configure network-level access control for Azure Cosmos DB

Azure Cosmos DB is a globally distributed, multi-model database service offered by Microsoft Azure, which provides seamless scalability, high availability, and low latency access to your data. In this article, we will walk through the process of configuring network-level access control for Azure Cosmos DB, ensuring secure access to your database resources.

Step 1: Navigate to Azure Cosmos DB

To begin, open the Azure portal and search for “Azure Cosmos DB” in the search bar. Select your Cosmos DB account from the list of available options.

Step 2: Open Firewall and Virtual Networks settings

In the left-hand menu, locate the “Firewall and Virtual Networks” option under the “Settings” section, and click on it to access the corresponding settings.

Step 3: Enable Virtual Network Access

If you want to restrict access to specific virtual networks, toggle the “Virtual Network” option to “Enabled”. Enabling this option will restrict access to your Cosmos DB account from outside the selected virtual networks.

Step 4: Add IP Firewall Rules

To allow access to your Cosmos DB account from specific IP addresses or IP ranges, follow these steps:

1. Click on the “+ Add an IP Firewall Rule” button.
2. Enter a name for the firewall rule in the “Name” field.
3. Specify the starting and ending IP addresses in the “Start IP address” and “End IP address” fields to define an IP range. Alternatively, you can enter a single IP address in the “Start IP address” field to allow access from only that IP.
4. Click on the “Save” button to add the firewall rule.

Step 5: Add Virtual Network Service Endpoints

If you have enabled virtual network access, you can further enhance security by adding virtual network service endpoints. Follow these steps:

1. Click on the “+ Add virtual network service endpoint” button.
2. Select the desired virtual network and virtual network subnet from the corresponding dropdown lists.
3. Click on the “Save” button to add the virtual network service endpoint.

Step 6: Save Firewall and Virtual Networks Settings

After adding the necessary IP firewall rules and virtual network service endpoints, click on the “Save” button to apply the changes to your Cosmos DB account.

By configuring network-level access control, you can restrict access to your Azure Cosmos DB resources, ensuring that only trusted IP addresses and virtual networks have access. This provides an additional layer of security for your database environment.

Example Configuration

Below is an example of how the configuration might look:

Firewall Rule:
Name: MyIPRange
Start IP address: 10.0.0.0
End IP address: 10.0.0.255

Virtual Network Service Endpoint:
Virtual Network: myVirtualNetwork
Subnet: mySubnet

Remember to regularly review and update your network-level access control settings based on your evolving needs and requirements.