The Azure Cosmos DB account does not configure a customer-managed encryption key because key_vault_key_id is omitted from the azurerm_cosmosdb_account resource. As a result, data at rest is protected only by Microsoft-managed keys, reducing customer control over key rotation, revocation, separation of duties, and cryptographic governance. This may violate security or compliance requirements where sensitive data must be encrypted using keys controlled by the organisation.

Remediation

Configure Cosmos DB to use a customer-managed key stored in Azure Key Vault by setting key_vault_key_id. Ensure the Cosmos DB managed identity has the required permissions to access the key, and define a key rotation and revocation process aligned with organisational security requirements.

Metadata

• Severity: medium
• Slug: missing-customer-managed-key-encryption-on-azure-cosmos-db

Tags

• Azure

CWEs

• 922: Insecure Storage of Sensitive Information

OWASP

• A02:2021: Cryptographic Failures