Ensure that your Microsoft Azure Cosmos DB accounts are using the Automatic Failover feature in order to enable resource replication and fault tolerance at the account level. Automatic failover allows Azure Cosmos DB to failover to the Azure cloud region with the highest failover priority when the source region become unavailable, without any additional action from the application or the user. The Cosmos DB account must have two or more regions configured in order to enable the feature.
This rule resolution is part of the Conformity Security & Compliance tool for Azure.
In the event of a write region outage, the Azure Cosmos DB account will automatically promote a secondary region to be the new primary write region when enable automatic failover is enabled within the Azure Cosmos DB account settings. The failover occurs to another Azure region in the order of the region priority that you have specified within the feature settings.
Audit
To determine if automatic failover is enabled for your Microsoft Azure Cosmos DB accounts, perform the following operations:
Remediation / Resolution
To enable automatic failover for your Microsoft Azure Cosmos DB accounts, perform the following operations:
Note: This conformity rule assumes that your Azure Cosmos DB accounts are used in production and have two or more Azure regions configured for automatic failover.References
- Azure Official Documentation
- High availability with Azure Cosmos DB
- Manage an Azure Cosmos account
- Enable automatic failover
- Azure Command Line Interface (CLI) Documentation
- az cosmosdb list
- az cosmosdb show
- az cosmosdb update
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Enable Automatic Failover
Risk Level: Medium