This document describes the architecture for secure deployment of PostgreSQL database in Azure using Cosmos DB for PostgreSQL. The solution is designed with Zero Trust and Defense in Depth principles, following Azure security best practices.
┌─────────────────────────────────────────────────────────────────┐
│ Azure Subscription │
│ ┌───────────────────────────────────────────────────────────┐ │
│ │ Resource Group │ │
│ │ │ │
│ │ ┌─────────────────────────────────────────────────────┐ │ │
│ │ │ Virtual Network │ │ │
│ │ │ 10.0.0.0/16 │ │ │
│ │ │ │ │ │
│ │ │ ┌─────────────────┐ ┌────────────────────────┐ │ │ │
│ │ │ │ Database Subnet │ │ Private Endpoint │ │ │ │
│ │ │ │ 10.0.1.0/24 │ │ Subnet │ │ │ │
│ │ │ │ │ │ 10.0.2.0/24 │ │ │ │
│ │ │ │ │ │ │ │ │ │
│ │ │ │ │ │ ┌─────────────────┐ │ │ │ │
│ │ │ │ │ │ │ Private │ │ │ │ │
│ │ │ │ │ │ │ Endpoint │ │ │ │ │
│ │ │ │ │ │ └─────────────────┘ │ │ │ │
│ │ │ └─────────────────┘ └────────────────────────┘ │ │ │
│ │ └─────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ ┌─────────────────────────────────────────────────────┐ │ │
│ │ │ Cosmos DB for PostgreSQL │ │ │
│ │ │ (Public Access Disabled) │ │ │
│ │ └─────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────────┐ │ │
│ │ │ Key Vault │ │ Managed │ │ Log Analytics │ │ │
│ │ │ │ │ Identity │ │ Workspace │ │ │
│ │ └─────────────┘ └─────────────┘ └─────────────────┘ │ │
│ └───────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
❌ PostgreSQL Cosmos DB does NOT support subnet delegation (Microsoft.DocumentDB/databaseAccounts)
✅ Only Cassandra clusters support delegation (Microsoft.DocumentDB/cassandraClusters)
✅ PostgreSQL uses Private Endpoints instead of subnet delegation
- CIDR: 10.0.0.0/16
- Purpose: Isolated network environment for all resources
- Security: Complete isolation from internet by default
- Purpose: Hosting Cosmos DB for PostgreSQL
- Delegation: None (not supported for PostgreSQL)
- NSG: Strict security rules
- Routing: Internet access blocked
- Purpose: Hosting private endpoints
- Policies: Network policies disabled for private endpoints
- NSG: Only necessary traffic allowed
Inbound Traffic Rules:
- Allow PostgreSQL (5432) from Private Endpoint Subnet
- Allow HTTPS (443) from Private Endpoint Subnet
- Deny All Other Inbound
Outbound Traffic Rules:
- Allow All (can be restricted based on requirements)
Outbound Traffic Rules:
- Allow PostgreSQL (5432) to Database Subnet
- Allow HTTPS (443) to Database Subnet
- Allow DNS (53) to Any
- Deny All Other Outbound
- CIDR: 10.0.0.0/16
- Purpose: Isolated network environment for all resources
- Security: Complete isolation from internet by default
- Purpose: Hosting Cosmos DB for PostgreSQL
- Delegation: None (PostgreSQL does not support subnet delegation)
- NSG: Strict security rules
- Routing: Internet access blocked
- Purpose: Hosting private endpoints
- Policies: Network policies disabled for private endpoints
- NSG: Only necessary traffic allowed
Inbound Traffic Rules:
- Allow PostgreSQL (5432) from Private Endpoint Subnet
- Allow HTTPS (443) from Private Endpoint Subnet
- Deny All Other Inbound
Outbound Traffic Rules:
- Allow All (can be restricted based on requirements)
Outbound Traffic Rules:
- Allow PostgreSQL (5432) to Database Subnet
- Allow HTTPS (443) to Database Subnet
- Allow DNS (53) to Any
- Deny All Other Outbound
- Type: Fully managed PostgreSQL service
- Configuration: Single coordinator node (1 vCore, 128GB storage)
- Public Access: Disabled
- Connection: Only through private endpoint
- Backup: Automatic, configurable retention period
- Purpose: Storage for secrets, keys and certificates
- Access: Restricted through Azure services
- Encryption: Customer Managed Keys for Cosmos DB
- Audit: Complete logging of all operations
- Type: User Assigned Managed Identity
- Purpose: Secure authentication without passwords
- Access: To Key Vault and Cosmos DB
- RBAC: Minimum necessary permissions
- Zone: privatelink.postgres.cosmos.azure.com
- Purpose: Name resolution for private endpoints
- Link: To virtual network
- Purpose: Centralized logging
- Retention: 30 days
- Logs: Diagnostic logs from all resources
- Metrics: Database performance
- Alerts: Configurable notifications
- Dashboards: Real-time monitoring
- All connections are verified and authorized
- No trust by default
- Principle of least privilege
- Network Level: NSG, routing, private endpoints
- Identity Level: Managed Identity, RBAC
- Data Level: Encryption at rest and in transit
- Application Level: Secure connection strings
- Monitoring Level: Logging and alerts
- Component isolation in separate subnets
- Traffic control through NSG
- Internet access blocked by default
- Personal data encryption
- Data location control
- Audit trails
- Right to be forgotten
- Access controls
- Security monitoring
- Change management
- Incident response
- Payment data protection
- Secure network architecture
- Regular security testing
- Access monitoring
- Resource Group creation
- Virtual Network setup
- Subnet configuration
- NSG rules application
- Key Vault deployment
- Managed Identity creation
- RBAC assignments
- Secret generation
- Cosmos DB for PostgreSQL deployment
- Private endpoint creation
- DNS configuration
- Connection testing
- Log Analytics workspace
- Diagnostic settings
- Alert rules
- Dashboard setup
- Cosmos DB: Start with 1 vCore coordinator
- Storage: 128GB with auto-scaling
- Log Analytics: 30-day retention
- Consider reservations for production
- Cost savings up to 65%
- 1-year or 3-year terms
- Cost alerts and budgets
- Resource utilization tracking
- Right-sizing recommendations
- Automatic backups every 24 hours
- Point-in-time recovery
- Configurable retention (7-35 days)
- Built-in redundancy
- Automatic failover
- 99.9% SLA
- Vertical scaling (vCores)
- Storage auto-scaling
- Read replicas for read workloads
- Connection pooling
- Query optimization
- Index strategies