Cosmos DB accounts should have key-based metadata write access disabled
Ensure Cosmos DB accounts have key-based metadata write_access disabled. This control is non-compliant if Cosmos DB accounts have key-based metadata write access enabled. The Azure Policy targets Microsoft.DocumentDB/databaseAccounts.
Ensure cosmosdb does not allow privileged escalation by restricting management plane changes.
What this control checks
Cosmos DB accounts must have key-based metadata write access disabled; enabled access is.
Common pitfalls
Check inspects access_key_metadata_writes_enabled
The check inspects access_key_metadata_writes_enabled on azurerm_cosmosdb_account. The expected value is False.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Cosmos DB key based metadata write access should be disabled" (4750c32b-89c0-46af-bfcb-2e4541a818d5); PowerPipe control azure_compliance.control.cosmosdb_account_key_based_metadata_write_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_132.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cosmosdb_account_key_based_metadata_write_access_disabled - Checkov Check:
CKV_AZURE_132 - Powerpipe Control:
azure_compliance.control.cosmosdb_account_key_based_metadata_write_access_disabled - Azure Policy Definition:
4750c32b-89c0-46af-bfcb-2e4541a818d5
Last reviewed: 2026-10-11