How to securely connect azure static web app with cosmos mongo db?

Hi @Sunny Chawla
To securely connect an Azure Static Web App with Azure Cosmos DB using the MongoDB API,

Ensure your Azure Cosmos DB allows access from your Azure Static Web App. Configure your Cosmos DB account to permit connections from all networks or specific IP addresses.

Create a private endpoint for your Azure Cosmos DB to enable secure access within your virtual network.

Use Azure Key Vault to manage your connection strings securely. Store your Cosmos DB connection string in the Key Vault to avoid hardcoding sensitive information in your application.

Set up a Service Connector in your Azure Static Web App to connect to your Cosmos DB by:

• Selecting the Cosmos DB resource.
• Configuring the connector to use the Key Vault for secrets storage.
• Ensuring the connector uses a managed identity for authentication.

Retrieve the connection string from the Key Vault in your application code, and ensure your application uses the correct environment variables to access the Cosmos DB.

Test the connection from your Azure Static Web App to the Cosmos DB, check for errors in the logs, and troubleshoot as needed.
References:

Tutorial: Deploy a Node.js + MongoDB web app to Azure (azure-portal)

Integrate Azure Cosmos DB for MongoDB with Service Connector
https://learn.microsoft.com/en-us/azure/static-web-apps/database-azure-cosmos-db?tabs=bash
Let me know if you have any further assistances.

Thank you for your reply!

If I setup azure cosmos Db to accept all networks, is this approach secure?

Can I get outbound IP address of Azure static web app?

Can I restrict access of cosmos Db only to this azure static web app that is publicly accessible?

Hi Sunny Chawla,

1. No, this is not secure. Allowing access from all networks exposes your Cosmos DB to the public internet, increasing the risk of unauthorized access, brute-force attacks, and data breaches, even if authentication is required.

Recommended Approach:

• Use Private Endpoints to restrict access to trusted networks.
• If public access is temporarily needed (e.g., for development), restrict it to specific IP ranges.
• Always use RBAC and Managed Identity for secure access control.

2. No, Azure Static Web Apps do not have fixed outbound IPs. They are serverless and multi-tenant, so their outbound IPs are dynamic and not published by Microsoft.

Workaround:

• Use an Azure Function App (Premium Plan or App Service Plan) with VNet integration.
• These services can have static outbound IPs, which you can whitelist in Cosmos DB.

3. Not directly, Azure Static Web Apps are public facing and cannot be integrated into a VNet, so Cosmos DB cannot restrict access based on the Static Web App alone.

Secure Solution:

• Use an Azure Function backend that is VNet-integrated.
• The Static Web App communicates with the Function, and the Function securely accesses Cosmos DB via a private endpoint.
• This keeps your database isolated while still allowing secure access from your app.

Document for reference-https://learn.microsoft.com/en-us/azure/azure-functions/functions-create-vnet

Similar thread which may help you - https://learn.microsoft.com/en-us/answers/questions/2121722/query-a-cosmosdb-with-private-endpoint-from-a-stat

If you have any further assistant, do let me know.

Hello Sunny Chawla,

As per Siva’s suggestion, the recommended approach is to use an Azure Function App (Premium or App Service Plan) with VNet integration as a secure API layer between your Azure Static Web App and Cosmos DB. This setup ensures secure communication using a Private Endpoint and Managed Identity.

If you need further assistance or have any questions, please feel free to comment. I will be happy to help you.