services / Azure / Cosmos DB container copy jobs

Container copy jobs are Cosmos DB data-movement operations that copy or migrate the contents of a container between containers or database accounts.

Although the job resource is control-plane configuration, the write operation moves the actual production database data, so this resource type sits close to a production data store.

Microsoft.​DocumentDB/​databaseAccounts/​copyJobs/​write

Creating a copy job can replicate production container data to an attacker-influenced destination account (bulk exfiltration / automated collection), writes into the target container (manipulation), and consumes throughput/RU cost.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Automated data collection (BOOST)
4. Spend (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links