Cosmos DB accounts on Periodic backup with retention proven below 24 hours
What does ZopNight detect here?
Cosmos DB accounts on a Periodic backup policy with retention positively reported below 24 hours are flagged by rule RC-1336. That is less than one day of recoverable history and no point-in-time restore. Continuous-mode accounts never fire, and a missing retention value abstains, because Resource Graph often omits the nested periodic properties.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1336 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | cosmos_backup.go |
Where it applies
Less than a day of recoverable history
Azure’s default Periodic backup for Cosmos DB keeps two copies taken four hours apart, roughly 8 hours of recoverable history. Delete the wrong documents on Friday evening and discover it Monday morning, and there is nothing left to restore: every surviving backup already contains the mistake. That is the exposure this rule describes: not a missing backup system, but a retention window shorter than the time it typically takes a human to notice data damage.
What provably weak means here
Two metadata values drive the verdict, both stamped by the discoverer from the account’s
live ARM backupPolicy (a read under the built-in Reader role). backup_policy_type
distinguishes Periodic from Continuous; Continuous means point-in-time restore is available
and the rule never fires on it. For Periodic accounts, backup_retention_hours must be
positively surfaced and parse to a number strictly below the 24-hour floor before the
finding is raised. Only that combination fires, at medium severity: Periodic, with retention known and
under one day.
Read the backup policy on an account
az cosmosdb show -n <account> -g <rg> \ --query "{mode: backupPolicy.type, retentionHours: backupPolicy.periodicModeProperties.backupRetentionIntervalInHours, intervalMinutes: backupPolicy.periodicModeProperties.backupIntervalInMinutes}"Output showing Periodic with retentionHours under 24 reproduces the finding exactly.
Why a missing value never fires
Azure Resource Graph frequently declines to project the nested periodicModeProperties, so a
healthy Periodic account with a generous retention window can reach the recommender with no
retention value at all. Absence therefore means “not surfaced”, never “not configured”, and
the rule abstains on it, as it does on an unparseable value or a missing policy type. The
practical consequence: some genuinely under-protected accounts will not be flagged. The rule
trades that miss for never accusing a correctly configured account, so treat its findings as
proven and its silence as unverified.
Choosing Continuous
For production data, the durable fix is switching the account to Continuous mode, which replaces the snapshot-copy model with point-in-time restore across the retention period. Where Periodic must stay (Continuous has feature and cost implications that not every account tolerates), raise the retention interval well past a day so the recovery window outlives a weekend. Both changes live under the account’s Backup and Restore settings.