services / Azure / Container copy jobs

Container copy (data transfer) jobs that move/replicate data between Azure Cosmos DB containers, accounts, or external stores within a database account.

Job definitions reference source and destination containers and govern bulk movement of production database data.

Microsoft.​DocumentDB/​databaseAccounts/​dataTransferJobs/​write

Creating a container copy job can duplicate a production container's contents to an attacker-chosen destination (another account/container/store), enabling bulk data exfiltration, and writes/overwrites data at the destination.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links