services / Azure / Cosmos DB database account

An Azure Cosmos DB (DocumentDB) database account, the top-level control-plane resource that hosts databases and containers and governs endpoints, regions, consistency, networking, identity, and backup configuration. It is a primary production data store.

Account master keys are root-equivalent data-plane credentials granting full read/write access to all data in the account, which makes this resource type security-sensitive.

Microsoft.​DocumentDB/​databaseAccounts/​delete

Destroys the entire Cosmos account and all databases and containers within it, permanently destroying every dataset the account holds. Cosmos accounts are frequently shared across an entire application or multiple tenants, so impact is typically organization-wide.

Risks

1. Data destruction (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links