where can i find cosmsosdb encryption details

Question

I need cosmosdb encryption details for audit

Answer 1

Hi,

Please see documents below:

Data encryption in Azure Cosmos DB

https://learn.microsoft.com/en-us/azure/cosmos-db/database-encryption-at-rest

Overview of database security in Azure Cosmos DB

https://learn.microsoft.com/en-us/azure/cosmos-db/database-security

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Answer 2

Hi mohammedm834@ninjacart.com •,

Welcome to Micrsoft Q&A forum.

As I understand, you want to know about Azure Cosmos DB encryption details.

If your Cosmos DB is MongoDB Vcore, then refer https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/vcore/database-encryption-at-rest.

If other APIs, Encryption at rest is implemented by using several security technologies, including secure key storage systems, encrypted networks, and cryptographic APIs. Systems that decrypt and process data have to communicate with systems that manage keys. The diagram shows how storage of encrypted data and the management of keys is separated.

The basic flow of a user request is:

• The user database account is made ready, and storage keys are retrieved via a request to the Management Service Resource Provider.
• A user creates a connection to Azure Cosmos DB via HTTPS/secure transport. (The SDKs abstract the details.)
• The user sends a JSON document to be stored over the previously created secure connection.
• The JSON document is indexed unless the user has turned off indexing.
• Both the JSON document and index data are written to secure storage.
• Periodically, data is read from the secure storage and backed up to the Azure Encrypted Blob Store.

Data stored in your Azure Cosmos DB account is automatically and seamlessly encrypted with keys managed by Microsoft by using service-managed keys. Optionally, you can choose to add a second layer of encryption with keys you manage by using customer-managed keys.

Microsoft has a set of internal guidelines for encryption key rotation, which Azure Cosmos DB follows. The specific guidelines aren't published. Microsoft does publish the Security Development Lifecycle, which is seen as a subset of internal guidance and has useful best practices for developers.

You can Configure customer-managed keys for your Azure Cosmos DB account with Azure Key Vault following https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-customer-managed-keys?source=recommendations&tabs=azure-portal

You can refer to the Security section in the official documentation page:

https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-customer-managed-keys?source=recommendations&tabs=azure-portal

Hope this helps. Let us know if further queries.

Thanks.