services / Azure / Cosmos DB database account

An Azure Cosmos DB (DocumentDB) database account, the top-level control-plane resource that hosts databases and containers and governs endpoints, regions, consistency, networking, identity, and backup configuration. It is a primary production data store.

Account master keys are root-equivalent data-plane credentials granting full read/write access to all data in the account, which makes this resource type security-sensitive.

Microsoft.​DocumentDB/​databaseAccounts/​backup/​action

Triggers an external backup that copies the account's contents to a backup target, enabling automated collection and potential exfiltration of organizational data.

Risks

1. Data exfiltration (CRITICAL)
2. Automated data collection (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links