Skip to content

Azure.Cosmos.NoSQLNaming.md

Latest commit

 

History

History
193 lines (156 loc) · 6.31 KB

Azure.Cosmos.NoSQLNaming.md

File metadata and controls

193 lines (156 loc) · 6.31 KB
Raw
reviewed 2025-11-24
severity Awareness
pillar Operational Excellence
category OE:04 Tools and processes
resource Cosmos DB for NoSQL account
resourceType Microsoft.DocumentDb/databaseAccounts
online version https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Cosmos.NoSQLNaming/

Cosmos DB for NoSQL account resources must use standard naming

SYNOPSIS

Cosmos DB for NoSQL account resources without a standard naming convention may be difficult to identify and manage.

DESCRIPTION

An effective naming convention allows operators to quickly identify resources, related systems, and their purpose. Identifying resources easily is important to improve operational efficiency, reduce the time to respond to incidents, and minimize the risk of human error.

Some of the benefits of using standardized tagging and naming conventions are:

  • They provide consistency and clarity for resource identification and discovery across the Azure Portal, CLIs, and APIs.
  • They enable filtering and grouping of resources for billing, monitoring, security, and compliance purposes.
  • They support resource lifecycle management, such as provisioning, decommissioning, backup, and recovery.

For example, if you come upon a security incident, it's critical to quickly identify affected systems, the functions that those systems support, and the potential business impact.

For Cosmos DB for NoSQL account, the Cloud Adoption Framework (CAF) recommends using the cosno- prefix.

Requirements for Cosmos DB for NoSQL account resource names:

  • Between 3 and 44 characters long.
  • Can include alphanumeric characters, hyphens, underscores, and periods (restrictions vary by resource type).
  • Resource names must be unique within their scope.

RECOMMENDATION

Consider creating Cosmos DB for NoSQL account resources with a standard name. Additionally consider using Azure Policy to only permit creation using a standard naming convention.

EXAMPLES

Configure with Bicep

To deploy accounts that pass this rule:

  • Set the name property to a string that matches the naming requirements.
  • Optionally, consider constraining name parameters with minLength and maxLength attributes.

For example:

@minLength(3)
@maxLength(44)
@description('The name of the resource.')
param name string

@description('The location resources will be deployed.')
param location string = resourceGroup().location

@description('The location of a secondary replica.')
param secondaryLocation string = location

resource nosql 'Microsoft.DocumentDB/databaseAccounts@2025-04-15' = {
  name: name
  location: location
  properties: {
    enableFreeTier: false
    consistencyPolicy: {
      defaultConsistencyLevel: 'Session'
    }
    databaseAccountOfferType: 'Standard'
    locations: [
      {
        locationName: location
        failoverPriority: 0
        isZoneRedundant: true
      }
      {
        locationName: secondaryLocation
        failoverPriority: 1
        isZoneRedundant: false
      }
    ]
    disableKeyBasedMetadataWriteAccess: true
    minimalTlsVersion: 'Tls12'
  }
}

Configure with Azure template

To deploy accounts that pass this rule:

  • Set the name property to a string that matches the naming requirements.
  • Optionally, consider constraining name parameters with minLength and maxLength attributes.
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "name": {
      "type": "string",
      "minLength": 3,
      "maxLength": 44,
      "metadata": {
        "description": "The name of the resource."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "The location resources will be deployed."
      }
    },
    "secondaryLocation": {
      "type": "string",
      "defaultValue": "[parameters('location')]",
      "metadata": {
        "description": "The location of a secondary replica."
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.DocumentDB/databaseAccounts",
      "apiVersion": "2025-04-15",
      "name": "[parameters('name')]",
      "location": "[parameters('location')]",
      "properties": {
        "enableFreeTier": false,
        "consistencyPolicy": {
          "defaultConsistencyLevel": "Session"
        },
        "databaseAccountOfferType": "Standard",
        "locations": [
          {
            "locationName": "[parameters('location')]",
            "failoverPriority": 0,
            "isZoneRedundant": true
          },
          {
            "locationName": "[parameters('secondaryLocation')]",
            "failoverPriority": 1,
            "isZoneRedundant": false
          }
        ],
        "disableKeyBasedMetadataWriteAccess": true,
        "minimalTlsVersion": "Tls12"
      }
    }
  ]
}

NOTES

This rule does not check if Cosmos DB for NoSQL account resource names are unique.

Rule configuration

To configure this rule set the AZURE_COSMOS_NOSQL_NAME_FORMAT configuration value to a regular expression that matches the required format.

For example:

configuration:
  AZURE_COSMOS_NOSQL_NAME_FORMAT: '^cosno-'

LINKS