Azure Cosmos DB Account Access Key
Detects Azure Cosmos DB account access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: structurally constrained Base64 key pattern with Cosmos DB context keywords reduces false positive rates significantly. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
- Data categories
- credentials, security
- Scope
- specific
- Risk rating
- 10
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported
Pattern
(?i)(?:AccountKey|cosmosdb[._-]?key)\s*=\s*[A-Za-z0-9+/\s]{43,92}={0,2}Corroborative evidence keywords
Cosmos DB, CosmosDB, DocumentDB, AccountKey, AccountEndpoint, cosmos, database account, access key, api key, api_key, apikey, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential (+44 more)
Proximity: 300 characters
Should match
AccountKey=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==— Cosmos DB account key (88 chars Base64)cosmosdb_key=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUV==— Cosmos DB key with mixed charactersAccountKey=00000000000000000000000000000000000000000000000000000000000000000000000000000000000000==— Cosmos DB key with numeric test value
Should not match
AccountKey=shortkey— Too short to be a valid Cosmos DB keyAccountEndpoint=https://myaccount.documents.azure.com— Account endpoint URL, not a keytemplate example placeholder record identifier— Template/sample context should be excluded even when anchor words are present
Known false positives
- Azure Cosmos DB documentation and quickstart templates with placeholder keys. Mitigation: Check for common placeholder patterns and documentation file indicators.
- Other Azure service keys that use the same Base64 format. Mitigation: Use Cosmos DB specific corroborative keywords to differentiate from other services.