Cosmos DB

Filters

  • Standard Value Filter (see Generic Filters)
  • ARM Resource Filters (see Generic Filters)

    • Metric Filter - Filter on metrics from Azure Monitor - (see Cosmos DB Supported Metrics)

    • Tag Filter - Filter on tag presence and/or values

    • Marked-For-Op Filter - Filter on tag that indicates a scheduled operation for a resource

  • firewall-rules Firewall Rules Filter

    Filter based on firewall rules. Rules can be specified as x.x.x.x-y.y.y.y or x.x.x.x or x.x.x.x/y.

    • include: the list of IP ranges or CIDR that firewall rules must include. The list must be a subset of the exact rules as is, the ranges will not be combined.

    • equal: the list of IP ranges or CIDR that firewall rules must match exactly.

    oneOf:
- required:
  - type
  - include
- required:
  - type
  - any
- required:
  - type
  - only
- required:
  - type
  - equal
properties:
  any:
    items:
      type: string
    type: array
  equal:
    items:
      type: string
    type: array
  include:
    items:
      type: string
    type: array
  only:
    items:
      type: string
    type: array
  type:
    enum:
    - firewall-rules

Actions

Example Policies

This policy will find all CosmosDB with 1000 or less total requests over the last 72 hours

policies:
  - name: cosmosdb-inactive
    resource: azure.cosmosdb
    filters:
      - type: metric
        metric: TotalRequests
        op: le
        aggregation: total
        threshold: 1000
        timeframe: 72