Azure Cosmos DB Firewall: Allow the Proxy’s Public Egress IP
Match Cosmos DB’s IP firewall to the public egress address actually used by the forward proxy.
Routing a Cosmos DB client through a forward proxy changes the network source seen by the database account. An IP firewall that allows the workstation’s direct public address can therefore reject the proxied request.
For an account using public access with selected networks, allow the proxy path’s public egress IP or approved range. This may be a NAT address beyond the proxy, rather than the hostname or private address the Python client uses to reach its listener.
Use the proxy operator’s assigned egress information. A rotating exit pool needs an appropriate stable route or an approved set of exit addresses; allowing one observed address is unreliable when subsequent connections use others.
Cosmos DB documents a 403 response for requests outside its IP allowlist. Firewall updates can take up to 15 minutes to propagate. Keep the database account’s normal authorization credentials in place, because an allowed network source still needs valid authorization.