Defender: Azure Cosmos DB should disable public network access

CHANGELOG.md

@@ -59,6 +59,7 @@ BUG FIXES:
 * Fix Azure ML network tags to use name rather than ID ([[#4151](https://github.com/microsoft/AzureTRE/issues/4151)])
 * Windows R version must be 4.1.2 otherwise post install script doesn't update package mirror URL ([#4288](https://github.com/microsoft/AzureTRE/issues/4288))
 * Recreate tre_output.json if empty. ([[#4292](https://github.com/microsoft/AzureTRE/issues/4292)])
+* Defender: Azure Cosmos DB should disable public network access ([#4322](https://github.com/microsoft/AzureTRE/issues/4322))
 
 COMPONENTS:
 

core/terraform/cosmos_mongo.tf

@@ -1,12 +1,13 @@
 resource "azurerm_cosmosdb_account" "mongo" {
-  name                       = "cosmos-mongo-${var.tre_id}"
-  location                   = azurerm_resource_group.core.location
-  resource_group_name        = azurerm_resource_group.core.name
-  offer_type                 = "Standard"
-  kind                       = "MongoDB"
-  automatic_failover_enabled = false
-  mongo_server_version       = 4.2
-  ip_range_filter            = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  name                          = "cosmos-mongo-${var.tre_id}"
+  location                      = azurerm_resource_group.core.location
+  resource_group_name           = azurerm_resource_group.core.name
+  offer_type                    = "Standard"
+  kind                          = "MongoDB"
+  automatic_failover_enabled    = false
+  mongo_server_version          = 4.2
+  ip_range_filter               = var.enable_local_debugging ? "${local.azure_portal_cosmos_ips},${local.myip}" : ""
+  public_network_access_enabled = var.enable_local_debugging
 
   capabilities {
     name = "EnableServerless"

core/terraform/locals.tf

@@ -14,7 +14,7 @@ locals {
   docker_registry_server = data.azurerm_container_registry.mgmt_acr.login_server
 
   # https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall#allow-requests-from-the-azure-portal
-  azure_portal_cosmos_ips = "104.42.195.92,40.76.54.131,52.176.6.30,52.169.50.45,52.187.184.26"
+  azure_portal_cosmos_ips = "13.91.105.215,4.210.172.107,13.88.56.148,40.91.218.243"
 
   # we define some zones in core despite not used by the core infra because
   # it's the easier way to make them available to other services in the system.

core/terraform/statestore.tf

@@ -5,9 +5,10 @@ resource "azurerm_cosmosdb_account" "tre_db_account" {
   offer_type                    = "Standard"
   kind                          = "GlobalDocumentDB"
   automatic_failover_enabled    = false
-  ip_range_filter               = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  ip_range_filter               = var.enable_local_debugging ? "${local.azure_portal_cosmos_ips},${local.myip}" : ""
   local_authentication_disabled = true
   tags                          = local.tre_core_tags
+  public_network_access_enabled = var.enable_local_debugging
 
   dynamic "capabilities" {
     # We can't change an existing cosmos

core/version.txt

@@ -1 +1 @@
-__version__ = "0.11.22"
+__version__ = "0.11.23"