Azure Cosmos DB Dev/Test with Multi-Region Replication
1
1
medium
What does ZopNight detect here?
Non-production Cosmos DB accounts with geo-replication enabled are flagged for collapsing to a single region. Savings are computed as cost × (N−1)/N from the discovered regionCount when it is at least 2; the rule abstains when regionCount is missing or the account lacks a positive dev/test signal.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1337 |
| Category | rightsizing |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | cosmos_multiregion.go |
Where it applies
The geo-replication flag and the non-prod proof
- metadata: geo_replication_enabled=true (the Azure discoverer derives this from the account’s locations[]/failoverPolicies[] arrays at resource_graph.go:3275 and emits “true” for multi-region/geo-replicated accounts). The prior tag: multi_region=true read was never produced; the producer emits the equivalent signal under geo_replication_enabled in Metadata.
- metadata: regionCount (number of configured locations) is required to price; when present and ≥2, it drives savings = cost × (N−1)/N. There is a producer gap: the discoverer’s failoverPolicies fallback path sets geo_replication_enabled=“true” without stamping regionCount, so on that path the rule abstains (returns nil) rather than fabricate. The prior conservative 0.50 fallback fraction was removed (concrete-or-abstain, 2026-06-27).
- positive non-prod signal, evaluated by the rule-local cosmosNonProdReason (same gating/priority as isNonProdResource: env tag / name / resource group, prod env tag is an absolute veto): abstains unless the account is positively non-prod (audit 2026-06-26 pattern A: skipping only prod-named accounts wrongly treated every neutral name as non-prod).
- pricing required (SetPricing); abstains when cost ≤ 0.
Why collapsing N regions drops (N-1)/N of cost
A real topology delta: cost × (regionCount−1)/regionCount when regionCount (≥2) is in Metadata (collapsing N replicated regions to one drops (N−1)/N of the linearly-scaled replicated RU cost; fraction in (0,1), so savings < cost). The rule abstains (returns nil) when regionCount is absent (the producer gap on the failoverPolicies fallback path), with no fabricated fraction (concrete-or-abstain, 2026-06-27).
Collapsing a dev/test account to one region
- Verify this is a non-production Cosmos DB account