services / Azure / Cosmos DB restorable database account

A restorable (backup) record of an Azure Cosmos DB database account, capturing point-in-time-restore metadata for existing and previously-deleted accounts in a region.

Exposes recovery-estate metadata (account IDs, regions, creation/deletion timestamps, restore windows) but not the underlying database contents; the restore action that consumes it is the high-impact capability.

Microsoft.​DocumentDB/​Locations/​restorableDatabaseAccounts/​restore/​action

Submitting a point-in-time restore rehydrates the backed-up Cosmos DB account's full contents into a new, attacker-controllable account, materializing organizational data for exfiltration while provisioning a costly new database account.

Risks

1. Data exfiltration (CRITICAL)
2. Spend (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links