Governance Transforms Cosmos Db - Azure/az-prototype GitHub Wiki
Automatic corrections for Cosmos DB ARM schema fabrications
Domain: data
| Check | Description |
|---|---|
| TFM-CDB-001 | Replace capacityMode with EnableServerless capability |
| TFM-CDB-002 | Inject backupPolicy for serverless Cosmos DB accounts |
Replace capacityMode with EnableServerless capability
Rationale: The Cosmos DB ARM schema does not have a capacityMode property. Setting it is silently ignored and serverless mode is not activated. The correct pattern uses capabilities with EnableServerless.
Agents: terraform-agent, bicep-agent
- Microsoft.DocumentDB/databaseAccounts
Type: Regex
Search: 'capacityMode\s*=\s*"[Ss]erverless"'
Replace: 'capabilities = [{ name = "EnableServerless" }]'
Inject backupPolicy for serverless Cosmos DB accounts
Rationale: Serverless Cosmos DB accounts require backupPolicy.type = Continuous. ARM rejects Periodic for serverless, and omitting backupPolicy entirely causes undefined behavior on some API versions.
Agents: terraform-agent, bicep-agent
- Microsoft.DocumentDB/databaseAccounts
Type: Regex
Search: '(capabilities\s*=\s*\[\s*\{\s*name\s*=\s*"EnableServerless"\s*\}\s*\])(?!\s*\n\s*backupPolicy)'
Replace: '\1 backupPolicy = { type = "Continuous" continuousModeProperties = { tier = "Continuous7Days" } } '