Skip to content

Commit d960b50

Browse files
BernieWhiteBernieWhite
authored
Check that database accounts use a paid tier Azure#2845 (Azure#2847)
1 parent c8f4903 commit d960b50

9 files changed

+164
-8
lines changed

‎data/policy-ignore.json

+7
Original file line numberDiff line numberDiff line change
@@ -259,5 +259,12 @@
259259
],
260260
"reason": "Duplicate",
261261
"value": "Azure.SQL.Auditing"
262+
},
263+
{
264+
"policyDefinitionIds": [
265+
"/providers/Microsoft.Authorization/policyDefinitions/4750c32b-89c0-46af-bfcb-2e4541a818d5"
266+
],
267+
"reason": "Duplicate",
268+
"value": "Azure.Cosmos.DisableMetadataWrite"
262269
}
263270
]

‎docs/CHANGELOG-v1.md

+4
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
3535

3636
What's changed since v1.36.0:
3737

38+
- New rules:
39+
- Cosmos DB:
40+
- Check that database accounts use a paid tier by @BernieWhite.
41+
[#2845](https://github.com/Azure/PSRule.Rules.Azure/issues/2845)
3842
- General improvements:
3943
- Quality updates to documentation by @BernieWhite.
4044
[#2570](https://github.com/Azure/PSRule.Rules.Azure/issues/2570)

‎docs/en/rules/Azure.Cosmos.DisableMetadataWrite.md

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
reviewed: 2024-04-09
2+
reviewed: 2024-05-01
33
severity: Important
44
pillar: Security
55
category: SE:05 Identity and access management
@@ -48,6 +48,7 @@ For example:
4848
"name": "[parameters('name')]",
4949
"location": "[parameters('location')]",
5050
"properties": {
51+
"enableFreeTier": false,
5152
"consistencyPolicy": {
5253
"defaultConsistencyLevel": "Session"
5354
},
@@ -77,6 +78,7 @@ resource account 'Microsoft.DocumentDB/databaseAccounts@2023-04-15' = {
7778
name: name
7879
location: location
7980
properties: {
81+
enableFreeTier: false
8082
consistencyPolicy: {
8183
defaultConsistencyLevel: 'Session'
8284
}
@@ -93,6 +95,13 @@ resource account 'Microsoft.DocumentDB/databaseAccounts@2023-04-15' = {
9395
}
9496
```
9597

98+
### Configure with Azure Policy
99+
100+
To address this issue at runtime use the following policies:
101+
102+
- [Azure Cosmos DB key based metadata write access should be disabled](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Cosmos%20DB/Cosmos_DisableMetadata_Append.json)
103+
`/providers/Microsoft.Authorization/policyDefinitions/4750c32b-89c0-46af-bfcb-2e4541a818d5`
104+
96105
## LINKS
97106

98107
- [SE:05 Identity and access management](https://learn.microsoft.com/azure/well-architected/security/identity-access)

‎docs/en/rules/Azure.Cosmos.SLA.md

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
reviewed: 2024-05-01
3+
severity: Important
4+
pillar: Reliability
5+
category: RE:04 Target metrics
6+
resource: Cosmos DB
7+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Cosmos.SLA/
8+
---
9+
10+
# Use paid tier for production workloads
11+
12+
## SYNOPSIS
13+
14+
Use a paid tier to qualify for a Service Level Agreement (SLA).
15+
16+
## DESCRIPTION
17+
18+
Cosmos DB offers one account on selected subscriptions to be marked to use a free tier allowance of 1000 DTUs.
19+
This free tier is intended for developers to try Cosmos DB during early development and proof of concepts (PoC).
20+
Using the free tier offer is not intended to be used for production level workloads.
21+
22+
When using the free tier, the SLA for Cosmos DB does not apply.
23+
24+
## RECOMMENDATION
25+
26+
Consider using a paid SKU to qualify for a Service Level Agreement (SLA).
27+
28+
## EXAMPLES
29+
30+
### Configure with Azure template
31+
32+
To deploy Cosmos DB accounts that pass this rule:
33+
34+
- Set the `properties.enableFreeTier` property to `false` or do not configure the property.
35+
36+
For example:
37+
38+
```json
39+
{
40+
"type": "Microsoft.DocumentDB/databaseAccounts",
41+
"apiVersion": "2023-04-15",
42+
"name": "[parameters('name')]",
43+
"location": "[parameters('location')]",
44+
"properties": {
45+
"enableFreeTier": false,
46+
"consistencyPolicy": {
47+
"defaultConsistencyLevel": "Session"
48+
},
49+
"databaseAccountOfferType": "Standard",
50+
"locations": [
51+
{
52+
"locationName": "[parameters('location')]",
53+
"failoverPriority": 0,
54+
"isZoneRedundant": true
55+
}
56+
],
57+
"disableKeyBasedMetadataWriteAccess": true
58+
}
59+
}
60+
```
61+
62+
### Configure with Bicep
63+
64+
To deploy Cosmos DB accounts that pass this rule:
65+
66+
- Set the `properties.enableFreeTier` property to `false` or do not configure the property.
67+
68+
For example:
69+
70+
```bicep
71+
resource account 'Microsoft.DocumentDB/databaseAccounts@2023-04-15' = {
72+
name: name
73+
location: location
74+
properties: {
75+
enableFreeTier: false
76+
consistencyPolicy: {
77+
defaultConsistencyLevel: 'Session'
78+
}
79+
databaseAccountOfferType: 'Standard'
80+
locations: [
81+
{
82+
locationName: location
83+
failoverPriority: 0
84+
isZoneRedundant: true
85+
}
86+
]
87+
disableKeyBasedMetadataWriteAccess: true
88+
}
89+
}
90+
```
91+
92+
## LINKS
93+
94+
- [RE:04 Target metrics](https://learn.microsoft.com/azure/well-architected/reliability/metrics)
95+
- [Try Azure Cosmos DB free](https://learn.microsoft.com/azure/cosmos-db/try-free)
96+
- [Azure Cosmos DB pricing](https://azure.microsoft.com/pricing/details/cosmos-db/autoscale-provisioned/)
97+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.documentdb/databaseaccounts)

‎docs/examples-cosmos.bicep

+2-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ param name string
99
@description('The location resources will be deployed.')
1010
param location string = resourceGroup().location
1111

12-
// An example Cosmos DB account using the NoSQL API.
12+
@description('A Cosmos DB account using the NoSQL API.')
1313
resource account 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' = {
1414
name: name
1515
location: location
@@ -31,6 +31,7 @@ resource account 'Microsoft.DocumentDB/databaseAccounts@2023-11-15' = {
3131
}
3232
}
3333

34+
@description('A No SQL API database in a Cosmos DB account.')
3435
resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2023-11-15' = {
3536
name: 'sql-001'
3637
parent: account

‎docs/examples-cosmos.json

+9-3
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
"metadata": {
55
"_generator": {
66
"name": "bicep",
7-
"version": "0.26.54.24096",
8-
"templateHash": "12996554638761229869"
7+
"version": "0.26.170.59819",
8+
"templateHash": "14244543187074389953"
99
}
1010
},
1111
"parameters": {
@@ -44,6 +44,9 @@
4444
],
4545
"disableKeyBasedMetadataWriteAccess": true,
4646
"minimalTlsVersion": "Tls12"
47+
},
48+
"metadata": {
49+
"description": "A Cosmos DB account using the NoSQL API."
4750
}
4851
},
4952
{
@@ -57,7 +60,10 @@
5760
},
5861
"dependsOn": [
5962
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
60-
]
63+
],
64+
"metadata": {
65+
"description": "A No SQL API database in a Cosmos DB account."
66+
}
6167
}
6268
]
6369
}

‎src/PSRule.Rules.Azure/rules/Azure.Cosmos.Rule.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -70,4 +70,22 @@ spec:
7070
field: properties.minimalTlsVersion
7171
equals: Tls12
7272

73+
---
74+
# Synopsis: Use a paid tier to qualify for a Service Level Agreement (SLA).
75+
apiVersion: github.com/microsoft/PSRule/v1
76+
kind: Rule
77+
metadata:
78+
name: Azure.Cosmos.SLA
79+
ref: AZR-000419
80+
tags:
81+
release: GA
82+
ruleSet: 2024_06
83+
Azure.WAF/pillar: Reliability
84+
spec:
85+
type:
86+
- Microsoft.DocumentDb/databaseAccounts
87+
condition:
88+
field: properties.enableFreeTier
89+
hasDefault: false
90+
7391
#endregion Rules

‎tests/PSRule.Rules.Azure.Tests/Azure.Cosmos.Tests.ps1

+16-2
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,26 @@ Describe 'Azure.Cosmos' -Tag 'Cosmos', 'CosmosDB' {
5656
# Fail
5757
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' });
5858
$ruleResult.Length | Should -Be 4;
59-
$ruleResult.TargetName | Should -Be 'graph-B', 'nosql-A', 'nosql-B', 'nosql-C';
59+
$ruleResult.TargetName | Should -BeIn 'graph-B', 'nosql-A', 'nosql-B', 'nosql-C';
6060

6161
# Pass
6262
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' });
6363
$ruleResult.Length | Should -Be 1;
64-
$ruleResult.TargetName | Should -Be 'graph-A';
64+
$ruleResult.TargetName | Should -BeIn 'graph-A';
65+
}
66+
67+
It 'Azure.Cosmos.SLA' {
68+
$filteredResult = $result | Where-Object { $_.RuleName -eq 'Azure.Cosmos.SLA' };
69+
70+
# Fail
71+
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' });
72+
$ruleResult.Length | Should -Be 1;
73+
$ruleResult.TargetName | Should -BeIn 'graph-A';
74+
75+
# Pass
76+
$ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' });
77+
$ruleResult.Length | Should -Be 4;
78+
$ruleResult.TargetName | Should -BeIn 'graph-B', 'nosql-A', 'nosql-B', 'nosql-C';
6579
}
6680
}
6781

‎tests/PSRule.Rules.Azure.Tests/Resources.Cosmos.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
"virtualNetworkRules": [],
2727
"EnabledApiTypes": "Gremlin, Sql",
2828
"disableKeyBasedMetadataWriteAccess": false,
29-
"enableFreeTier": false,
29+
"enableFreeTier": true,
3030
"enableAnalyticalStorage": false,
3131
"analyticalStorageConfiguration": null,
3232
"createMode": "Default",

0 commit comments

Comments
 (0)