Securing an Azure Function












1















I'm trying to apply the least privilege principle to an Azure Function. What I want is to make a FunctionApp have only read access to a, for example, storage queue. What I've tried so far is:




  • Enable managed identity in the FunctionApp

  • Create a role that only allows read access to the queues (role definition below)

  • Go to the storage queue IAM permissions, and add a new role assignment, using the new role and the Function App.


But it didn't work. If I try to write to that queue from my function (using an output binding) the item is written, when I expected a failure. I've tried using the builtin role "Storage Queue Data Reader (Preview)" with the same result.



What's the right way to add/remove permissions of a Function App?



Role definition:



{
"Name": "Reader WorkingSA TestQueue Queue",
"IsCustom": true,
"Description": "Read TestQueue queue on WorkingSA storage accoung.",
"actions": ["Microsoft.Storage/storageAccounts/queueServices/queues/read"],
"dataActions": [
"Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
],
"notActions": ,
"notDataActions": ,
"AssignableScopes": [
"/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/TestAuth-dev-rg"
]
}









share|improve this question




















  • 2





    The queue that you are trying to write to, is that storage account the same account that the Function App is using ? Also, are you sure that the Storage Key is not being configured somewhere and is being used. Further I am not sure that the Azure Queue binding is configured to work with Azure Storage AAD. What you have to do is to assign the MSI the role you created and use the MSI to access the queue. Also read this: azure.microsoft.com/en-us/blog/…

    – anirudhgarg
    Nov 22 '18 at 21:24
















1















I'm trying to apply the least privilege principle to an Azure Function. What I want is to make a FunctionApp have only read access to a, for example, storage queue. What I've tried so far is:




  • Enable managed identity in the FunctionApp

  • Create a role that only allows read access to the queues (role definition below)

  • Go to the storage queue IAM permissions, and add a new role assignment, using the new role and the Function App.


But it didn't work. If I try to write to that queue from my function (using an output binding) the item is written, when I expected a failure. I've tried using the builtin role "Storage Queue Data Reader (Preview)" with the same result.



What's the right way to add/remove permissions of a Function App?



Role definition:



{
"Name": "Reader WorkingSA TestQueue Queue",
"IsCustom": true,
"Description": "Read TestQueue queue on WorkingSA storage accoung.",
"actions": ["Microsoft.Storage/storageAccounts/queueServices/queues/read"],
"dataActions": [
"Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
],
"notActions": ,
"notDataActions": ,
"AssignableScopes": [
"/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/TestAuth-dev-rg"
]
}









share|improve this question




















  • 2





    The queue that you are trying to write to, is that storage account the same account that the Function App is using ? Also, are you sure that the Storage Key is not being configured somewhere and is being used. Further I am not sure that the Azure Queue binding is configured to work with Azure Storage AAD. What you have to do is to assign the MSI the role you created and use the MSI to access the queue. Also read this: azure.microsoft.com/en-us/blog/…

    – anirudhgarg
    Nov 22 '18 at 21:24














1












1








1








I'm trying to apply the least privilege principle to an Azure Function. What I want is to make a FunctionApp have only read access to a, for example, storage queue. What I've tried so far is:




  • Enable managed identity in the FunctionApp

  • Create a role that only allows read access to the queues (role definition below)

  • Go to the storage queue IAM permissions, and add a new role assignment, using the new role and the Function App.


But it didn't work. If I try to write to that queue from my function (using an output binding) the item is written, when I expected a failure. I've tried using the builtin role "Storage Queue Data Reader (Preview)" with the same result.



What's the right way to add/remove permissions of a Function App?



Role definition:



{
"Name": "Reader WorkingSA TestQueue Queue",
"IsCustom": true,
"Description": "Read TestQueue queue on WorkingSA storage accoung.",
"actions": ["Microsoft.Storage/storageAccounts/queueServices/queues/read"],
"dataActions": [
"Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
],
"notActions": ,
"notDataActions": ,
"AssignableScopes": [
"/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/TestAuth-dev-rg"
]
}









share|improve this question
















I'm trying to apply the least privilege principle to an Azure Function. What I want is to make a FunctionApp have only read access to a, for example, storage queue. What I've tried so far is:




  • Enable managed identity in the FunctionApp

  • Create a role that only allows read access to the queues (role definition below)

  • Go to the storage queue IAM permissions, and add a new role assignment, using the new role and the Function App.


But it didn't work. If I try to write to that queue from my function (using an output binding) the item is written, when I expected a failure. I've tried using the builtin role "Storage Queue Data Reader (Preview)" with the same result.



What's the right way to add/remove permissions of a Function App?



Role definition:



{
"Name": "Reader WorkingSA TestQueue Queue",
"IsCustom": true,
"Description": "Read TestQueue queue on WorkingSA storage accoung.",
"actions": ["Microsoft.Storage/storageAccounts/queueServices/queues/read"],
"dataActions": [
"Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
],
"notActions": ,
"notDataActions": ,
"AssignableScopes": [
"/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/TestAuth-dev-rg"
]
}






azure azure-active-directory azure-functions






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 23 '18 at 3:16









Hong Ooi

43.1k1097139




43.1k1097139










asked Nov 22 '18 at 16:15









vgaltesvgaltes

287311




287311








  • 2





    The queue that you are trying to write to, is that storage account the same account that the Function App is using ? Also, are you sure that the Storage Key is not being configured somewhere and is being used. Further I am not sure that the Azure Queue binding is configured to work with Azure Storage AAD. What you have to do is to assign the MSI the role you created and use the MSI to access the queue. Also read this: azure.microsoft.com/en-us/blog/…

    – anirudhgarg
    Nov 22 '18 at 21:24














  • 2





    The queue that you are trying to write to, is that storage account the same account that the Function App is using ? Also, are you sure that the Storage Key is not being configured somewhere and is being used. Further I am not sure that the Azure Queue binding is configured to work with Azure Storage AAD. What you have to do is to assign the MSI the role you created and use the MSI to access the queue. Also read this: azure.microsoft.com/en-us/blog/…

    – anirudhgarg
    Nov 22 '18 at 21:24








2




2





The queue that you are trying to write to, is that storage account the same account that the Function App is using ? Also, are you sure that the Storage Key is not being configured somewhere and is being used. Further I am not sure that the Azure Queue binding is configured to work with Azure Storage AAD. What you have to do is to assign the MSI the role you created and use the MSI to access the queue. Also read this: azure.microsoft.com/en-us/blog/…

– anirudhgarg
Nov 22 '18 at 21:24





The queue that you are trying to write to, is that storage account the same account that the Function App is using ? Also, are you sure that the Storage Key is not being configured somewhere and is being used. Further I am not sure that the Azure Queue binding is configured to work with Azure Storage AAD. What you have to do is to assign the MSI the role you created and use the MSI to access the queue. Also read this: azure.microsoft.com/en-us/blog/…

– anirudhgarg
Nov 22 '18 at 21:24












1 Answer
1






active

oldest

votes


















1














@anirudhgarg has pointed the right way.



The managed identity and RBAC you set makes difference only when you use managed identity access token to reach Storage service in Function app. It means those settings have no effect on function binding as it internally connects to Storage using connection string. If you haven't set connection property for the output binding, it leverages the AzureWebJobsStorage app settings by default.



To be more specific, connection string has nothing to do with Azure Active Directory Authentication process so it can't be influenced by AAD configuration. Hence if a function takes advantage of Storage Account connection string(e.g. uses Storage related binding), we can't limit its access with other settings. Likewise, no connection string usage means no access.



Update for using SAS token



If the queue mentioned is used in a Queue Trigger/input binding, we can restrict function with read and process(get message then delete)access, here comes SAS token.



Prerequisite:




  1. Queue locates at Storage account other than the one specified by AzureWebJobsStorage app setting. AzureWebJobsStorage requires connection string offering full access with Account key.


  2. Function app is 2.0. Check it on Function app settings> Runtime version: 2.xx (~2). In 1.x it requires more permissions like AzureWebJobsStorage.



Then get SAS token on portal as below and put it in app settings.



enter image description here






share|improve this answer


























  • Thanks @JerryLiu, Then, if I've understood correctly, if we're using the storeage binding for the queue, we can't rely on the AAD to control the permissions. I guess the same applies if I try to use the .Net API, as I need a connection string there. Will it work if I use a Shared Access Signature as explained here?

    – vgaltes
    Nov 23 '18 at 11:26













  • @vgaltes See my update.

    – Jerry Liu
    Nov 23 '18 at 13:16











  • Thanks @Jerry-Liu. Last question: does that mean that I can only give the same permissions to all the queues in the storage? Is there any way to give different permissions to different queues?

    – vgaltes
    Nov 23 '18 at 13:58






  • 1





    @vgaltes Use different connection strings for different queue bindings. For example, in a queue output binding we can use another sas connection string with Read and Add permission.

    – Jerry Liu
    Nov 23 '18 at 14:03











Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53434852%2fsecuring-an-azure-function%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









1














@anirudhgarg has pointed the right way.



The managed identity and RBAC you set makes difference only when you use managed identity access token to reach Storage service in Function app. It means those settings have no effect on function binding as it internally connects to Storage using connection string. If you haven't set connection property for the output binding, it leverages the AzureWebJobsStorage app settings by default.



To be more specific, connection string has nothing to do with Azure Active Directory Authentication process so it can't be influenced by AAD configuration. Hence if a function takes advantage of Storage Account connection string(e.g. uses Storage related binding), we can't limit its access with other settings. Likewise, no connection string usage means no access.



Update for using SAS token



If the queue mentioned is used in a Queue Trigger/input binding, we can restrict function with read and process(get message then delete)access, here comes SAS token.



Prerequisite:




  1. Queue locates at Storage account other than the one specified by AzureWebJobsStorage app setting. AzureWebJobsStorage requires connection string offering full access with Account key.


  2. Function app is 2.0. Check it on Function app settings> Runtime version: 2.xx (~2). In 1.x it requires more permissions like AzureWebJobsStorage.



Then get SAS token on portal as below and put it in app settings.



enter image description here






share|improve this answer


























  • Thanks @JerryLiu, Then, if I've understood correctly, if we're using the storeage binding for the queue, we can't rely on the AAD to control the permissions. I guess the same applies if I try to use the .Net API, as I need a connection string there. Will it work if I use a Shared Access Signature as explained here?

    – vgaltes
    Nov 23 '18 at 11:26













  • @vgaltes See my update.

    – Jerry Liu
    Nov 23 '18 at 13:16











  • Thanks @Jerry-Liu. Last question: does that mean that I can only give the same permissions to all the queues in the storage? Is there any way to give different permissions to different queues?

    – vgaltes
    Nov 23 '18 at 13:58






  • 1





    @vgaltes Use different connection strings for different queue bindings. For example, in a queue output binding we can use another sas connection string with Read and Add permission.

    – Jerry Liu
    Nov 23 '18 at 14:03
















1














@anirudhgarg has pointed the right way.



The managed identity and RBAC you set makes difference only when you use managed identity access token to reach Storage service in Function app. It means those settings have no effect on function binding as it internally connects to Storage using connection string. If you haven't set connection property for the output binding, it leverages the AzureWebJobsStorage app settings by default.



To be more specific, connection string has nothing to do with Azure Active Directory Authentication process so it can't be influenced by AAD configuration. Hence if a function takes advantage of Storage Account connection string(e.g. uses Storage related binding), we can't limit its access with other settings. Likewise, no connection string usage means no access.



Update for using SAS token



If the queue mentioned is used in a Queue Trigger/input binding, we can restrict function with read and process(get message then delete)access, here comes SAS token.



Prerequisite:




  1. Queue locates at Storage account other than the one specified by AzureWebJobsStorage app setting. AzureWebJobsStorage requires connection string offering full access with Account key.


  2. Function app is 2.0. Check it on Function app settings> Runtime version: 2.xx (~2). In 1.x it requires more permissions like AzureWebJobsStorage.



Then get SAS token on portal as below and put it in app settings.



enter image description here






share|improve this answer


























  • Thanks @JerryLiu, Then, if I've understood correctly, if we're using the storeage binding for the queue, we can't rely on the AAD to control the permissions. I guess the same applies if I try to use the .Net API, as I need a connection string there. Will it work if I use a Shared Access Signature as explained here?

    – vgaltes
    Nov 23 '18 at 11:26













  • @vgaltes See my update.

    – Jerry Liu
    Nov 23 '18 at 13:16











  • Thanks @Jerry-Liu. Last question: does that mean that I can only give the same permissions to all the queues in the storage? Is there any way to give different permissions to different queues?

    – vgaltes
    Nov 23 '18 at 13:58






  • 1





    @vgaltes Use different connection strings for different queue bindings. For example, in a queue output binding we can use another sas connection string with Read and Add permission.

    – Jerry Liu
    Nov 23 '18 at 14:03














1












1








1







@anirudhgarg has pointed the right way.



The managed identity and RBAC you set makes difference only when you use managed identity access token to reach Storage service in Function app. It means those settings have no effect on function binding as it internally connects to Storage using connection string. If you haven't set connection property for the output binding, it leverages the AzureWebJobsStorage app settings by default.



To be more specific, connection string has nothing to do with Azure Active Directory Authentication process so it can't be influenced by AAD configuration. Hence if a function takes advantage of Storage Account connection string(e.g. uses Storage related binding), we can't limit its access with other settings. Likewise, no connection string usage means no access.



Update for using SAS token



If the queue mentioned is used in a Queue Trigger/input binding, we can restrict function with read and process(get message then delete)access, here comes SAS token.



Prerequisite:




  1. Queue locates at Storage account other than the one specified by AzureWebJobsStorage app setting. AzureWebJobsStorage requires connection string offering full access with Account key.


  2. Function app is 2.0. Check it on Function app settings> Runtime version: 2.xx (~2). In 1.x it requires more permissions like AzureWebJobsStorage.



Then get SAS token on portal as below and put it in app settings.



enter image description here






share|improve this answer















@anirudhgarg has pointed the right way.



The managed identity and RBAC you set makes difference only when you use managed identity access token to reach Storage service in Function app. It means those settings have no effect on function binding as it internally connects to Storage using connection string. If you haven't set connection property for the output binding, it leverages the AzureWebJobsStorage app settings by default.



To be more specific, connection string has nothing to do with Azure Active Directory Authentication process so it can't be influenced by AAD configuration. Hence if a function takes advantage of Storage Account connection string(e.g. uses Storage related binding), we can't limit its access with other settings. Likewise, no connection string usage means no access.



Update for using SAS token



If the queue mentioned is used in a Queue Trigger/input binding, we can restrict function with read and process(get message then delete)access, here comes SAS token.



Prerequisite:




  1. Queue locates at Storage account other than the one specified by AzureWebJobsStorage app setting. AzureWebJobsStorage requires connection string offering full access with Account key.


  2. Function app is 2.0. Check it on Function app settings> Runtime version: 2.xx (~2). In 1.x it requires more permissions like AzureWebJobsStorage.



Then get SAS token on portal as below and put it in app settings.



enter image description here







share|improve this answer














share|improve this answer



share|improve this answer








edited Nov 23 '18 at 13:15

























answered Nov 23 '18 at 9:20









Jerry LiuJerry Liu

11.4k11334




11.4k11334













  • Thanks @JerryLiu, Then, if I've understood correctly, if we're using the storeage binding for the queue, we can't rely on the AAD to control the permissions. I guess the same applies if I try to use the .Net API, as I need a connection string there. Will it work if I use a Shared Access Signature as explained here?

    – vgaltes
    Nov 23 '18 at 11:26













  • @vgaltes See my update.

    – Jerry Liu
    Nov 23 '18 at 13:16











  • Thanks @Jerry-Liu. Last question: does that mean that I can only give the same permissions to all the queues in the storage? Is there any way to give different permissions to different queues?

    – vgaltes
    Nov 23 '18 at 13:58






  • 1





    @vgaltes Use different connection strings for different queue bindings. For example, in a queue output binding we can use another sas connection string with Read and Add permission.

    – Jerry Liu
    Nov 23 '18 at 14:03



















  • Thanks @JerryLiu, Then, if I've understood correctly, if we're using the storeage binding for the queue, we can't rely on the AAD to control the permissions. I guess the same applies if I try to use the .Net API, as I need a connection string there. Will it work if I use a Shared Access Signature as explained here?

    – vgaltes
    Nov 23 '18 at 11:26













  • @vgaltes See my update.

    – Jerry Liu
    Nov 23 '18 at 13:16











  • Thanks @Jerry-Liu. Last question: does that mean that I can only give the same permissions to all the queues in the storage? Is there any way to give different permissions to different queues?

    – vgaltes
    Nov 23 '18 at 13:58






  • 1





    @vgaltes Use different connection strings for different queue bindings. For example, in a queue output binding we can use another sas connection string with Read and Add permission.

    – Jerry Liu
    Nov 23 '18 at 14:03

















Thanks @JerryLiu, Then, if I've understood correctly, if we're using the storeage binding for the queue, we can't rely on the AAD to control the permissions. I guess the same applies if I try to use the .Net API, as I need a connection string there. Will it work if I use a Shared Access Signature as explained here?

– vgaltes
Nov 23 '18 at 11:26







Thanks @JerryLiu, Then, if I've understood correctly, if we're using the storeage binding for the queue, we can't rely on the AAD to control the permissions. I guess the same applies if I try to use the .Net API, as I need a connection string there. Will it work if I use a Shared Access Signature as explained here?

– vgaltes
Nov 23 '18 at 11:26















@vgaltes See my update.

– Jerry Liu
Nov 23 '18 at 13:16





@vgaltes See my update.

– Jerry Liu
Nov 23 '18 at 13:16













Thanks @Jerry-Liu. Last question: does that mean that I can only give the same permissions to all the queues in the storage? Is there any way to give different permissions to different queues?

– vgaltes
Nov 23 '18 at 13:58





Thanks @Jerry-Liu. Last question: does that mean that I can only give the same permissions to all the queues in the storage? Is there any way to give different permissions to different queues?

– vgaltes
Nov 23 '18 at 13:58




1




1





@vgaltes Use different connection strings for different queue bindings. For example, in a queue output binding we can use another sas connection string with Read and Add permission.

– Jerry Liu
Nov 23 '18 at 14:03





@vgaltes Use different connection strings for different queue bindings. For example, in a queue output binding we can use another sas connection string with Read and Add permission.

– Jerry Liu
Nov 23 '18 at 14:03




















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53434852%2fsecuring-an-azure-function%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







這個網誌中的熱門文章

Xamarin.form Move up view when keyboard appear

Post-Redirect-Get with Spring WebFlux and Thymeleaf

Anylogic : not able to use stopDelay()