Agree and that is why building a secure Cloud Landing Zone for enterprises goes hand in hand enabling developers to have the autonomy with Guardrails This is m

Agree and that is why building a secure Cloud Landing Zone for enterprises goes hand in hand enabling developers to have the autonomy with Guardrails This is my early and potentially slightly erroneous understanding of the situation: - Jupiter Notebook support was enabled if you used the SQL API and not the Gremlin or MongoDB API. What is unclear is whether breaking out of the Notbook container gave you access to keys for just instances using SQL API or any API. - CosmoDB is very weak in enforcing identity perimeters so keys are a weak point. Enforcing something like hourly key rotations is left up to the customer to build. - Azure is pretty much an "it's public IP" unless you explicitly make it private. And even when they add controls like Private end points they have weird routing mechanisms that can result in traffic bypassing controls like hub firewalls. - Using things like CosmoDB firewalls, private endpoints, automatic regular key rotations, and only enabling features you need should have helped if this was a hostile breach. Take everything I said with a pinch of salt :)