Azure KV and FuncApp

1. Create a FunctionApp and add a system assigned identity to it. Create on the search bar and select func app. The go to the identity section and turn on the status button. This creates an identity and registers the func app in azure ad. Now we need to grant this identity permissions to read from KV

2. Create a Keyvault and create a secret. I have created 2 (Name = Anish and surname = Aravind)

3. Give the function app identity access to read the secrets from Keyvault

4. Select the certificates drop down and select Get and List. Since we need to read the secrets.

5. Save the changes

6. Go to the Configuration section in the function app and add the following values. Cliick on create new application setting. The setting is a key value pair. I have created 2 because I need to read 2 secrets from KV. The application setting key will be the key for the secret in KV.

Name : @Microsoft.KeyVault(SecretUri=secretidentifierfor the secret)

To get the secret identifier for the secret. Go to KV and click on the current version.

This takes you to a new blade. Copy the secret identifier and use it as the value for the application setting that we created.

Key -- name of the secret

Value -- @Microsoft.KeyVault(SecretUri=secretidentifierfor the secret)

Now simply read the values from keyvault as environment variables.

public static class Function1
{
[FunctionName("Function1")]
public static async Task<IActionResult> Run(
[HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
ILogger log)
{
log.LogInformation("C# HTTP trigger function processed a request.");
log.LogInformation("C# HTTP trigger function processed a request.");

var name = Environment.GetEnvironmentVariable("Name", EnvironmentVariableTarget.Process);
var surname = Environment.GetEnvironmentVariable("surname", EnvironmentVariableTarget.Process);

return new OkObjectResult($"Name {name}, Surname {surname}");
}
}

Output:

Comments

Azure AD Authentication And Authorization

ROLE BASED AUTHORIZATION Step1: Setup API. 1. Create an app registration and create an app role. Make sure that the app role is assigned to user and applications. We add it to both user groups and applications as this role can be then assigned to both users and applications. Scopes can only be assigned to apps. Now we can have only users with this role access our application. This app role behind the scenes adds an approles section to the manifest.json. We can directly add it to the manifest file also. Step 2: Setup an app registration for the UI/ WEB App. . We will grant this app the read role created in the API app (shown above). Go to Azure AD and select the UI app registration. When we register an application 2 elements get created. 1. App registration 2. Enterprise Application -- service principal that get created for the app Adding roles to applications Go to the App registration => API Persmissions => Add a Permission => My API's The My Api's sec...

Function APP and KV integration

Create a function App and enable system assigned identity Create a Keyvault and add a secret (Name in my case) Configure Access policies for the function app in keyvault Create an access policy in Key Vault for the application identity you created earlier. Enable the "Get" secret permission on this policy. Do not configure the "authorized application" or applicationId settings, as this is not compatible with a managed identity. https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used. We are granting our function app permissions to get and list all the secrets in this keyvault. Add Key Vault secrets reference in the Function App configuration Go to the keyvault and click on the secret we just created. Copy the secret identifier. We need to add this value to the function app configuration. @Microsof...

AZ-500 AppService Inside VNet

The intent is to create an appservice that is available inside a VNET. So we will create a vnet and put an appservice inside it. This Vnet will have 2 subnets. One that has the appservice and another one that will have a VM.. We need to make sure that this Appservice can be accessed only inside the VM (inside the same VNET) 1. Create a Vnet Total Address space is 256.. We split into 2 subnets 2. Create an Appservice in standard or above tier as the lower tiers dont support networking. and select the Vnet and select the sub2 subnet 3. Create a Virtual Machine inside sub1. 4. Go to Appservices and onto the networking tab and select Access Restrictions Create a rule and select VNET and subnet that we created earlier. We can also specify IP Address. Then this appservice can be accessed by the specified IP's only. So this appservice can only be accessed within subnet 1. Which is where we have deployed the VM.. From Internet Inside VM (Subnet 1)

Anish's Notebook

Search This Blog