Securing Cosmos DB: Ready for Production!
summary
Shows how to lock a Cosmos DB account down by creating a VNet + backend subnet, provisioning private endpoints (note: creation takes time and briefly disrupts access) and auto‑configuring the private link.documents.azure.com private DNS zone so name resolution maps to per‑region private IPs (Cosmos creates two endpoints because it’s global). Demonstrates JSON role definitions and assignments using Cosmos DB RBAC (portal can’t create custom data roles), managed identities, and diagnostic logging for audit.
AI-written summary · about
chapters (7)
- 0:00Introduction to Cosmos DB security
- 7:48Demo private endpoints setup
- 14:44Networking theory deep dive
- 25:50Global replication networking
- 31:01Access control options overview
- 35:39RBAC with Cosmos DB RBAC
- 43:09Summary and Q&A
related talks
28mSecuring Azure Cosmos DB using Microsoft Defender
19mEnhancing Security in Azure Cosmos DB: Best Practices
28mSecuring Azure Cosmos DB using Microsoft Defender
19mKeyless Connections to Azure Cosmos DB (RBAC auth for data)
19mKeyless Connections to Azure Cosmos DB
38mSecure Azure Resources using Azure Private Link
53mProtect Your Data: Azure Networking Essentials for Developers
01h 00mEverything You Always Wanted to Know About Azure Security But Were Afraid to Ask