Azure Compliance ControlsAzure Cosmos DB
Cosmos DB accounts should have key-based metadata write access disabled
Ensure Cosmos DB accounts have key-based metadata write_access disabled. This control is non-compliant if Cosmos DB accounts have key-based metadata write access enabled. The Azure Policy targets Microsoft.DocumentDB/databaseAccounts.
What this control checks
Azure Policy 4750c32b-89c0-46af-bfcb-2e4541a818d5 checks Microsoft.DocumentDB/databaseAccounts/disableKeyBasedMetadataWriteAccess.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cosmosdb_account_key_based_metadata_write_access_disabled - Checkov Check:
CKV_AZURE_132 - Powerpipe Control:
azure_compliance.control.cosmosdb_account_key_based_metadata_write_access_disabled - Azure Policy Definition:
4750c32b-89c0-46af-bfcb-2e4541a818d5
Last reviewed: 2026-10-11