Securing_Serverless_Applications_in_Azure.pdf

Slide 1

Slide 1 text

Serverless Applications Securing In Azure

Slide 2

Slide 2 text

About me @SjoukjeZaal https://www.sjoukjezaal.com Sjoukje Zaal Managing Consultant / Azure MVP

Slide 3

Slide 3 text

Slide 4

Slide 4 text

© 2020 Sjoukje Zaal What is Serverless Serverless is simplicity, but not necessarily simpler Source: Paul Johnston (former AWS Serverless developer advocate) Remember, there are NO servers! Source: Jeff Hollan (Microsoft PM Azure Functions)

Slide 5

Slide 5 text

© 2020 Sjoukje Zaal Microsoft Serverless Offering Azure Functions Run custom code on demand and at scale in the cloud. The runtime is completely open source and can run everywhere. Cosmos DB A globally distributed, multi-model database service that supports document, key-value, wide-column, and graph databases. Event Hubs Fully managed, real-time data ingestion service. Stream millions of events per second from any source. Event Grid Fully managed event routing service from Azure services or from your own apps. Logic Apps Workflow orchestration. Specify the process steps how to run your serverless application. Azure Storage Provides durable, highly available, and massively scalable cloud storage. Key Vault Secure key management, use to encrypt keys and small secrets like passwords. Cognitive Services Adds intelligent features such as vision face and speech recognition into your app.. Azure Search Search-as-a-service solution to build search experiences into web and mobile applications.

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

© 2020 Sjoukje Zaal Current scenario Contoso developed a serverless application that adds external customers to the Azure tenant and makes a custom marketing application available for the customers. Only Contoso employees can use the serverless application. They have used a Logic App to create the application. After an audit of the security department, the current solution does not comply with the organizations security and compliance regulations.

Slide 9

Slide 9 text

© 2020 Sjoukje Zaal x t x b All users with the link to the Logic App can access it The Logic App can be accessed by all types of applications The Tenant ID, App ID and App Secret are hard-coded in the Logic App No monitoring is setup for the applications Security issues Discovered by the security department

Slide 10

Slide 10 text

Slide 11

Slide 11 text

© 2020 Sjoukje Zaal z 8 6 ( Technical Security Building Blocks 01 Step 02 Step 03 Step 04 Step Azure Functions Secured using built-in authentication mechanism Managed Identities Accessing Azure resources securely Azure Key Vault Securely storing credentials Azure AD & Graph Register and Azure AD application and set permissions

Slide 12

Slide 12 text

Slide 13

Slide 13 text

© 2020 Sjoukje Zaal Functions Choose your App Service plan Use built-in Authentication and authorization Use custom SSL / domain Logic Apps Consumption model Uses a SAS token API Management Functions & Logic Apps Security feature and capability differences

Slide 14

Slide 14 text

© 2020 Sjoukje Zaal Authorization Authentication Options Azure Active Directory Microsoft accounts Social Media Identity accounts ClaimsPrincipal binding data Application Gateway (WAF) API Management Application Insights Azure Functions security

Slide 15

Slide 15 text

Slide 16

Slide 16 text

© 2020 Sjoukje Zaal Created the message queue To store new requests Created a request using an Azure AD registered user Passing on the ClaimsPrincipal Changed the authorization level for the function Enabled authentication / authorization for the Function Created the Function To initialize the workflow Step 1 Demo summary Step 2 Step 3 Step 4 Step 5

Slide 17

Slide 17 text

Slide 18

Slide 18 text

© 2020 Sjoukje Zaal Secure Azure Logic Apps security Authentication Azure AD Graph Managed Identities Integration Service Environment (ISE) Secure Outputs (Preview) Options Application Gateway (WAF) API Management Log Analytics Monitor &

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

© 2020 Sjoukje Zaal Created a system assigned managed identity Retrieving and parsing the queue message Into variables Created a new Logic App Using the Queue Trigger Connected to the queue using the managed identity Added the managed identity to the Key Vault Step 1 Demo summary Step 2 Step 3 Step 4 Step 5

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

© 2020 Sjoukje Zaal Created an Azure AD Application Set the application permissions Created a guest user in Azure AD Generated an Access token Retrieved Key Vault secrets in Logic App Enabled Secure Outputs Added the Tenant ID, App ID, and App Secret to the Key Vault Step 1 Demo summary Step 2 Step 3 Step 4 Step 5

Slide 29

Slide 29 text

Slide 30

Slide 30 text

© 2020 Sjoukje Zaal 3 2 1 Monitoring Serverless Apps Log Analytics Used by the Logic App Azure Monitor Aggregates and displays (log) data from several resources Application Insights Used by the Azure Function

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

© 2020 Sjoukje Zaal 01 02 03 Azure Functions only support Azure AD v1 Azure Function need to be configured for anonymous access Logic Apps Key Vault Connector doesn’t support Managed Identities b C s Wrap up Key takeaways

Slide 37

Slide 37 text

? any Are there questions?