Skip to main content
rightsizing · azure

Dev and test Cosmos DB accounts replicated to more than one region

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

Azure Cosmos DB reserves an account's provisioned throughput in every region it is replicated to, so N regions cost roughly N times one. ZopNight flags accounts it can positively identify as dev, test or staging that have 2 or more regions, and prices collapsing them to a single region as a saving of (N-1)/N of the account's cost.

Signal and threshold

How ZopNight evaluates Dev and test Cosmos DB accounts replicated to more than one region.
Field Value
Rule IDsRC-1337
Categoryrightsizing
Severitymedium
Metricnone — pure configuration read
Thresholdnon-production account with 2 or more regions
SourceZopNight
Permissions usedMicrosoft.DocumentDB/databaseAccounts/read

Every extra region repeats the throughput bill

Cosmos DB replicates data by adding regions to an account. Microsoft’s multi-region cost guide explains that the throughput configured for the account’s databases and containers is reserved in each associated region: with T RU/s provisioned and N regions, the account pays for T x N RU/s each hour. Storage is copied too. For production, that is the price of availability. For a development or test account created from a production template, it is a duplicate bill nobody needed.

Counting regions on your accounts

Terminal window
az cosmosdb list --query "[].{name:name, group:resourceGroup, regions:length(locations)}" -o table
az cosmosdb show --resource-group <rg> --name <account> \
--query "locations[].{region:locationName, priority:failoverPriority}" -o table

How ZopNight decides an account is non-production

The account must carry a positive non-production signal. It is checked in this order:

  1. A production environment tag (prod, production, prd or live on a key such as env, environment, stage or tier) is an absolute veto.
  2. A dev or test environment tag (dev, development, test, testing, qa, stage, staging, sandbox, sbx) qualifies the account.
  3. Otherwise the account name, then its resource group name, must contain dev, test, qa, staging, sandbox or demo. Names that look like infrastructure, such as devops, runner, agent, bastion or jumpbox, do not count.

The finding states which of these matched. A neutral name with no tags is not assumed to be non-production.

Accounts that get no finding

Beyond the non-production test, the account must be geo-replicated, its region count must be known and at least 2, and it must have a price. If the region count is not available, there is no finding rather than a guessed fraction. This check is about replicated regions, not about whether multi-region writes are turned on. Oversized throughput in a single region is covered by Azure Cosmos DB Provisioned Throughput Rightsizing.

Pricing a collapse to one region

Terminal window
saving = monthly cost x (regions - 1) / regions
cost after fix = monthly cost / regions

A two-region account saves half; a three-region account saves two thirds.

Removing the extra regions

  1. Confirm with the owning team that the account is not production and needs no cross-region copy.
  2. In the portal, open Replicate data globally and remove the extra regions, keeping the one the application uses.
  3. Or update the location list so only one region remains: az cosmosdb update --resource-group <rg> --name <account> --locations regionName=<region> failoverPriority=0 isZoneRedundant=False.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·