53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
id: azure-cosmosdb-auto-failover-missing
|
|
info:
|
|
name: Azure Cosmos DB Automatic Failover Not Enabled
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that your Microsoft Azure Cosmos DB accounts are using the Automatic Failover feature in order to enable resource replication and fault tolerance at the account level. Automatic failover allows Azure Cosmos DB to failover to the Azure cloud region with the highest failover priority when the source region becomes unavailable, without any additional action from the application or the user. The Cosmos DB account must have two or more regions configured in order to enable the feature.
|
|
impact: |
|
|
Not enabling Automatic Failover for Cosmos DB accounts may lead to increased downtime and data availability issues during regional outages.
|
|
remediation: |
|
|
Enable the Automatic Failover feature on your Azure Cosmos DB accounts to ensure high availability and fault tolerance across multiple regions.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/cosmos-db/high-availability
|
|
tags: cloud,devops,azure,microsoft,cosmosdb,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let CosmosDBData of iterate(template.cosmosDBAccounts)) {
|
|
set("id", CosmosDBData);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az cosmosdb list --query '[*].id' --output json
|
|
|
|
extractors:
|
|
- type: json
|
|
name: cosmosDBAccounts
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az cosmosdb show --ids $id --query 'enableAutomaticFailover' --output json
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "false"
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'id + " does not have Automatic Failover enabled"'
|
|
# digest: 4a0a0047304502206c5ddde87d7e863ee0cfa81fe53ec412df22118d7ba3724b2426fdbf85a41c5902210091b192a93529ee999d7fcc49cf687b28ed1024661b91f050bed54ba0d3bddfdc:922c64590222798bb761d5b6d8e72950 |