Easy Credential Administration in Azure – DZone – Uplaza

Azure Entra Id, previously Azure Energetic Listing is a complete Identification and Entry Administration providing from Microsoft. Whereas it encompasses many functionalities, the article will deal with Managed Identities.

Why Managed Identities?

Initially, Azure assets had been accessed utilizing connecting strings–keys tied to particular assets. As an illustration, for a storage account named “Foo”, its connection string may be “Bar”. This string could be saved in a Vault, and functions would retrieve it to entry the useful resource. 

A few of the challenges with this method had been:

• Key rotation: When a key rotation is carried out, the brand new key have to be up to date within the Vault. Service utilizing it needed to be notified in regards to the rotation.
• Safety dangers: The Storage Key acts like a Grasp Key, permitting any operation, together with deletion of the useful resource, to pose a danger in a manufacturing setting.

Then got here Service Principal and Function Primarily based Entry Management (RBAC). With this, the principal is assigned to an Azure Useful resource, equivalent to Storage, together with permissions like Blob Reader and Blob Author, proscribing operations the principal can carry out.

• Whereas this technique eased the administration of a number of connection strings and Safety Dangers, the necessity for handbook rotation of Service Principal consumer secrets and techniques/certificates failed to deal with the Key Rotation difficulty.

Varieties of Identities

Azure Entra has two choices, System Managed and Consumer Managed Identification.

Consumer Managed Identification

• This can be a standalone occasion, much like an Azure VM or an App Service. It creates a Service Principal managed by Azure.
• Like some other principal, the created principal may be connected to any useful resource and granted corresponding permissions. Azure assets requiring entry to the assigned useful resource can make the most of the consumer ID of the user-managed id to realize entry.

Use Case

• When assets and permissions should be managed individually, for instance, within the picture above, the lifecycle of the VM shouldn’t impression the permissions to both of the databases.

How To Create a Consumer Managed Identification

1. Log in to Azure Portal.
2. Go to Market Place -> Seek for “User Assigned Managed Identity” -> “Create”.
3. Choose Subscription, Useful resource Group, and Title. Click on Assessment + Create.
4. Think about assigning this id to a VM. Go to the VM -> Identification -> Consumer assigned.
5. Click on Add and add the user-managed id created beforehand.
6. Now, the VM has entry permissions assigned to this id.
7. To assign permissions to the Managed Identification, go to a useful resource for instance storage, choose the suitable function, and select the managed id within the members part.

Utilizing Consumer Managed Identification in Your Code

TokenCredential tokenCredential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId =  });

// Utilizing the id in Queue
QueueClient queue = new QueueClient(new Uri($"https://{storageName}.queue.core.windows.net/processors"), tokenCredential);
// Utilizing the id in Blob
BlobContainerClient blobContainer = new BlobContainerClient(new Uri($"https://{storageName}.blob.core.windows.net/processors"), tokenCredential));

System Managed Identification

• The id is linked to Azure Useful resource. For instance, making a VM or an App Service creates the useful resource and the Principal.
• Like some other principal, this may be related to any azure occasion.
• Nonetheless, deleting the useful resource additionally removes the corresponding principal.

Use Case

• When each permissions and assets should be deleted collectively.

How To Create a System-Managed Identification

1. Whereas making a useful resource, enabling the System Managed Identification possibility creates the id mechanically. For instance, when making a VM select “Enable system-assigned managed identity”

Utilizing System Managed Identification in Your Code

TokenCredential tokenCredential = new DefaultAzureCredential();

// Utilizing the id in Queue
QueueClient queue = new QueueClient(new Uri($"https://{storageName}.queue.core.windows.net/processors"), tokenCredential);
// Utilizing the id in Blob
BlobContainerClient blobContainer = new BlobContainerClient(new Uri($"https://{storageName}.blob.core.windows.net/processors"), tokenCredential));