Skip to content

Commit 6a2e367

Browse files
BenjaminEngesetBernieWhite
BenjaminEngeset
and
BernieWhite
authored
feat(new): Added Azure.Cosmos.ContinuousBackup (Azure#2967)
* feat(new): Added Azure.Cosmos.ContinuousBackup * fix: Fixed hardcoded culture * Update docs/en/rules/Azure.Cosmos.ContinuousBackup.md Co-authored-by: Bernie White <[email protected]> * Update docs/en/rules/Azure.Cosmos.ContinuousBackup.md Co-authored-by: Bernie White <[email protected]> * Update docs/en/rules/Azure.Cosmos.ContinuousBackup.md Co-authored-by: Bernie White <[email protected]> * Update docs/en/rules/Azure.Cosmos.ContinuousBackup.md Co-authored-by: Bernie White <[email protected]> * Update docs/en/rules/Azure.Cosmos.ContinuousBackup.md Co-authored-by: Bernie White <[email protected]> * Update docs/en/rules/Azure.Cosmos.ContinuousBackup.md Co-authored-by: Bernie White <[email protected]> * Update src/PSRule.Rules.Azure/rules/Azure.Cosmos.Rule.yaml Co-authored-by: Bernie White <[email protected]> * feat: Changed synopsis * feat: Updated changelog --------- Co-authored-by: Bernie White <[email protected]>
1 parent f7ccc3b commit 6a2e367

File tree

5 files changed

+267
-12
lines changed

5 files changed

+267
-12
lines changed

‎docs/CHANGELOG-v1.md

+5
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,11 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
2929

3030
## Unreleased
3131

32+
- New rules:
33+
- Cosmos DB:
34+
- Verify that Cosmos DB accounts have continuous backup configured by @BenjaminEngeset.
35+
[#2954](https://github.com/Azure/PSRule.Rules.Azure/issues/2954)
36+
3237
## v1.38.0-B0068 (pre-release)
3338

3439
What's changed since pre-release v1.38.0-B0034:

‎docs/en/rules/Azure.Cosmos.ContinuousBackup.md

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
severity: Important
3+
pillar: Reliability
4+
category: RE:06 Data partitioning
5+
resource: Cosmos DB
6+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Cosmos.ContinuousBackup/
7+
---
8+
9+
# Enable continuous backup policy
10+
11+
## SYNOPSIS
12+
13+
Enable continuous backup on Cosmos DB accounts.
14+
15+
## DESCRIPTION
16+
17+
Continuous backup for Azure Cosmos DB captures changes in near real-time, ensuring that you always have the most up-to-date backup.
18+
Data can be restored to any restorable timestamp within the retention period.
19+
20+
Benefits of continuous backup include:
21+
22+
- **Accidental Write or Delete Recovery**: Quickly recover from unintended changes within a container.
23+
- **Comprehensive Restoration**: Restore deleted accounts, databases, or containers.
24+
- **Regional Flexibility**: Restore data into any region where backups existed at the desired restore point.
25+
- **Ease of Use**: Restore data directly through the Azure portal without needing support requests.
26+
27+
These features typically improve your:
28+
29+
- **Recovery Time Objective (RTO)**: How long it take to recover, and systems are back online.
30+
- **Recovery Point Objective (RPO)**: The point in time you can recover to.
31+
32+
Continuous backup involves additional costs, so it is recommended for mission-critical applications with frequent data changes.
33+
34+
Check the documentation below for important information and limitations.
35+
36+
## RECOMMENDATION
37+
38+
Consider configuring Azure Cosmos DB with continuous backup mode for enhanced data protection (RTO & RPO) and easier recovery.
39+
40+
## EXAMPLES
41+
42+
### Configure with Azure template
43+
44+
To configure continuous backup for Cosmos DB:
45+
46+
- Set the `properties.backupPolicy.type` property to `Continuous`.
47+
- Set the `properties.backupPolicy.continuousModeProperties.tier` property to a valid tier.
48+
Valid tiers include `Continuous7Days` and `Continuous30Days`.
49+
50+
For example:
51+
52+
```json
53+
{
54+
"type": "Microsoft.DocumentDB/databaseAccounts",
55+
"apiVersion": "2024-05-15",
56+
"name": "[parameters('name')]",
57+
"location": "[parameters('location')]",
58+
"kind": "GlobalDocumentDB",
59+
"properties": {
60+
"disableLocalAuth": true,
61+
"locations": [
62+
{
63+
"locationName": "[parameters('location')]",
64+
"failoverPriority": 0,
65+
"isZoneRedundant": true
66+
}
67+
],
68+
"backupPolicy": {
69+
"type": "Continuous",
70+
"continuousModeProperties": {
71+
"tier": "Continuous7Days"
72+
}
73+
}
74+
}
75+
}
76+
```
77+
78+
### Configure with Bicep
79+
80+
To configure continuous backup for Cosmos DB:
81+
82+
- Set the `properties.backupPolicy.type` property to `Continuous`.
83+
- Set the `properties.backupPolicy.continuousModeProperties.tier` property to a valid tier.
84+
Valid tiers include `Continuous7Days` and `Continuous30Days`.
85+
86+
For example:
87+
88+
```bicep
89+
resource account 'Microsoft.DocumentDB/databaseAccounts@2024-05-15' = {
90+
name: name
91+
location: location
92+
kind: 'GlobalDocumentDB'
93+
properties: {
94+
disableLocalAuth: true
95+
locations: [
96+
{
97+
locationName: location
98+
failoverPriority: 0
99+
isZoneRedundant: true
100+
}
101+
]
102+
backupPolicy: {
103+
type: 'Continuous'
104+
continuousModeProperties: {
105+
tier: 'Continuous30Days'
106+
}
107+
}
108+
}
109+
}
110+
```
111+
112+
## NOTES
113+
114+
Azure Cosmos DB API for Cassandra does not support continuous backup mode currently.
115+
116+
## LINKS
117+
118+
- [RE:06 Data partitioning](https://learn.microsoft.com/azure/well-architected/reliability/partition-data)
119+
- [Continuous backup with point-in-time restore in Azure Cosmos DB](https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction)
120+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.documentdb/databaseaccounts)

‎src/PSRule.Rules.Azure/rules/Azure.Cosmos.Rule.yaml

+104
Original file line numberDiff line numberDiff line change
@@ -108,4 +108,108 @@ spec:
108108
field: properties.publicNetworkAccess
109109
equals: Disabled
110110

111+
---
112+
# Synopsis: Enable continuous backup on Cosmos DB accounts.
113+
apiVersion: github.com/microsoft/PSRule/v1
114+
kind: Rule
115+
metadata:
116+
name: Azure.Cosmos.ContinuousBackup
117+
ref: AZR-000439
118+
tags:
119+
release: GA
120+
ruleSet: 2024_09
121+
Azure.WAF/pillar: Reliability
122+
spec:
123+
type:
124+
- Microsoft.DocumentDb/databaseAccounts
125+
with:
126+
- Azure.Cosmos.IsMongo
127+
- Azure.Cosmos.IsGremlin
128+
- Azure.Cosmos.IsTable
129+
- Azure.Cosmos.IsNoSQL
130+
condition:
131+
allOf:
132+
- field: properties.backupPolicy.type
133+
equals: Continuous
134+
- field: properties.backupPolicy.continuousModeProperties.tier
135+
hasValue: true
136+
111137
#endregion Rules
138+
139+
#region Selectors
140+
141+
---
142+
# Synopsis: Cosmos DB accounts that use the Mongo API.
143+
apiVersion: github.com/microsoft/PSRule/v1
144+
kind: Selector
145+
metadata:
146+
name: Azure.Cosmos.IsMongo
147+
spec:
148+
if:
149+
field: properties.capabilities[*]
150+
allOf:
151+
- field: name
152+
equals: EnableMongo
153+
greaterOrEqual: 1
154+
155+
---
156+
# Synopsis: Cosmos DB accounts that use the Cassandra API.
157+
apiVersion: github.com/microsoft/PSRule/v1
158+
kind: Selector
159+
metadata:
160+
name: Azure.Cosmos.IsCassandra
161+
spec:
162+
if:
163+
field: properties.capabilities[*]
164+
allOf:
165+
- field: name
166+
equals: EnableCassandra
167+
greaterOrEqual: 1
168+
169+
---
170+
# Synopsis: Cosmos DB accounts that use the Gremlin API.
171+
apiVersion: github.com/microsoft/PSRule/v1
172+
kind: Selector
173+
metadata:
174+
name: Azure.Cosmos.IsGremlin
175+
spec:
176+
if:
177+
field: properties.capabilities[*]
178+
allOf:
179+
- field: name
180+
equals: EnableGremlin
181+
greaterOrEqual: 1
182+
183+
---
184+
# Synopsis: Cosmos DB accounts that use the Table API.
185+
apiVersion: github.com/microsoft/PSRule/v1
186+
kind: Selector
187+
metadata:
188+
name: Azure.Cosmos.IsTable
189+
spec:
190+
if:
191+
field: properties.capabilities[*]
192+
allOf:
193+
- field: name
194+
equals: EnableTable
195+
greaterOrEqual: 1
196+
197+
---
198+
# Synopsis: Cosmos DB accounts that use the NoSQL API.
199+
apiVersion: github.com/microsoft/PSRule/v1
200+
kind: Selector
201+
metadata:
202+
name: Azure.Cosmos.IsNoSQL
203+
spec:
204+
if:
205+
field: properties.capabilities[*]
206+
allOf:
207+
- field: name
208+
in:
209+
- EnableMongo
210+
- EnableCassandra
211+
- EnableTable
212+
- EnableGremlin
213+
count: 0
214+
215+
#endregion Selectors

‎tests/PSRule.Rules.Azure.Tests/Azure.Cosmos.Tests.ps1

+17
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,23 @@ Describe 'Azure.Cosmos' -Tag 'Cosmos', 'CosmosDB' {
105105
$ruleResult.Length | Should -Be 1;
106106
$ruleResult.TargetName | Should -BeIn 'nosql-C';
107107
}
108+
109+
It 'Azure.Cosmos.ContinuousBackup' {
110+
$filteredResult = $result | Where-Object { $_.RuleName -eq 'Azure.Cosmos.ContinuousBackup' };
111+
112+
# Fail
113+
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' });
114+
$ruleResult.Length | Should -Be 2;
115+
$ruleResult.TargetName | Should -BeIn 'graph-A', 'graph-B';
116+
117+
$ruleResult[0].Reason | Should -Be "Path properties.backupPolicy.type: The field 'properties.backupPolicy.type' does not exist.";
118+
$ruleResult[1].Reason | Should -Be "Path properties.backupPolicy.type: Is set to 'Periodic'.";
119+
120+
# Pass
121+
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' });
122+
$ruleResult.Length | Should -Be 3;
123+
$ruleResult.TargetName | Should -BeIn 'nosql-A', 'nosql-B', 'nosql-C';
124+
}
108125
}
109126

110127
Context 'Resource name - Azure.Cosmos.AccountName' {

‎tests/PSRule.Rules.Azure.Tests/Resources.Cosmos.json

+21-12
Original file line numberDiff line numberDiff line change
@@ -99,14 +99,6 @@
9999
"ipAddressOrRange": "52.187.184.26"
100100
}
101101
],
102-
"backupPolicy": {
103-
"type": "Periodic",
104-
"periodicModeProperties": {
105-
"backupIntervalInMinutes": 240,
106-
"backupRetentionIntervalInHours": 8,
107-
"backupStorageRedundancy": "Local"
108-
}
109-
},
110102
"networkAclBypassResourceIds": []
111103
},
112104
"ResourceGroupName": "rg-test",
@@ -264,7 +256,13 @@
264256
],
265257
"databaseAccountOfferType": "Standard",
266258
"enableAutomaticFailover": true,
267-
"minimalTlsVersion": "Tls"
259+
"minimalTlsVersion": "Tls",
260+
"backupPolicy": {
261+
"type": "Continuous",
262+
"continuousModeProperties": {
263+
"tier": "Continuous7Days"
264+
}
265+
}
268266
},
269267
"ResourceGroupName": "test-rg",
270268
"Type": "Microsoft.DocumentDB/databaseAccounts",
@@ -297,7 +295,13 @@
297295
"databaseAccountOfferType": "Standard",
298296
"enableAutomaticFailover": true,
299297
"disableLocalAuth": false,
300-
"publicNetworkAccess": "Enabled"
298+
"publicNetworkAccess": "Enabled",
299+
"backupPolicy": {
300+
"type": "Continuous",
301+
"continuousModeProperties": {
302+
"tier": "Continuous30Days"
303+
}
304+
}
301305
},
302306
"ResourceGroupName": "test-rg",
303307
"Type": "Microsoft.DocumentDB/databaseAccounts",
@@ -349,8 +353,13 @@
349353
"name": "EnableServerless"
350354
}
351355
],
352-
"publicNetworkAccess": "Disabled"
353-
356+
"publicNetworkAccess": "Disabled",
357+
"backupPolicy": {
358+
"type": "Continuous",
359+
"continuousModeProperties": {
360+
"tier": "Continuous30Days"
361+
}
362+
}
354363
},
355364
"ResourceGroupName": "test-rg",
356365
"Type": "Microsoft.DocumentDB/databaseAccounts",

0 commit comments

Comments
 (0)