services / Azure / Cosmos DB database account

An Azure Cosmos DB (DocumentDB) database account, the top-level control-plane resource that hosts databases and containers and governs endpoints, regions, consistency, networking, identity, and backup configuration. It is a primary production data store.

Account master keys are root-equivalent data-plane credentials granting full read/write access to all data in the account, which makes this resource type security-sensitive.

Microsoft.​DocumentDB/​databaseAccounts/​chaosFault/​action

Enables, disables, or checks the status of chaos-engineering fault injection against the live account. An attacker can enable faults to deliberately degrade or crash the database as a denial-of-service or as a distraction during a broader attack.

Risks

1. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links