Skip to main content

lacework-global-629

4.5.2 Ensure That Private Endpoints Are Used Where Possible (Automated)​

note

This rule has been changed to automated, see Automated Rules for CIS Azure 1.5.0 for details.

Profile Applicability​

• Level 2

Description​

Private endpoints limit network traffic to approved sources.

Rationale​

For sensitive data, private endpoints allow granular control of which services can communicate with Cosmos DB and ensure that this network traffic is private. You set this up on a case by case basis for each service you wish to be connected.

Impact​

Only whitelisted services will have access to communicate with the Cosmos DB.

Audit​

From Azure Portal​

  1. Open the portal menu.

  2. Select the Azure Cosmos DB blade

  3. Select the subscription you wish to audit.

  4. In the portal menu column select 'Private Endpoint Connections'.

  5. Select the Database you wish to audit.

  6. In this list view the private endpoints. In the column under 'Connection State' and the Private Endpoint is set to 'Enabled' it is active.

  7. Confirm that the radio button for 'allow access from' is set to 'selected networks'

  8. In the listing below confirm that the listed selected networks are set to the appropriate endpoints.

Remediation​

From Azure Portal​

  1. Open the portal menu.

  2. Select the Azure Cosmos DB blade

  3. Select the subscription you wish to audit.

  4. Select the Database you wish to add an endpoint to.

  5. Then in the portal menu column select the blade 'Private Endpoint Connections'.

  6. Click '+ Private Endpoint'

  7. Select which subscription and resource group you want the endpoint to be in. Name it as desired.

  8. Select which subscription the endpoint will be under, its resource type.

  9. Select which virtual network desired.

  10. Select the DNS servers the endpoint will contact.

  11. Tag as desired and create.

  12. Back in the Private Endpoints view, select the endpoint and associate it with the Cosmos DB.

  13. In the listing below confirm that the listed selected networks are set to the appropriate endpoints.

References​

https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoints
https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-cosmosdb-portal
https://docs.microsoft.com/en-us/cli/azure/cosmosdb/private-endpoint-connection?view=azure-cli-latest
https://docs.microsoft.com/en-us/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-create
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-network-security#ns-2-secure-cloud-services-with-network-controls