0

So I just created an Azure Function that is triggered by Azure Blob Storage upload. There is no HTTP trigger.

  • Why does this app have a PUBLIC-FACING URL?
  • How do I disable it?
  • Is there any kind of security mitigation needed?

https://fa06192020test8.azurewebsites.net (deleting soon, so hit it now!)

I don't want anything visible to the outside world.

SeaDude
  • 3,725
  • 6
  • 31
  • 68

2 Answers2

1
  • It's the standard welcome page for Azure Functions
  • You can disable it by setting AzureWebJobsDisableHomepage app setting value to true. However, you will still see a response when you hit the URL on the browser.
  • From a web perspective: not really. However, you always need to store your connection string in a secure place. For example, you shouldn't store your blob storage connection string in json file in your code. Obviously it's so hard to penetrate your FTP and get your JSON file, but still not secure. You can use Azure portal to set environment variables for the connection string. But still not the securest. You can have a look to the Azure KeyVault https://learn.microsoft.com/en-us/azure/key-vault/ and Managed Service Identity https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview if you really really want to build secure Azure Functions on your high-level ops (Let's say you're parsing some government, PCI, PHI, PII data)

Since it's only Azure Blob Trigger Azure Functions, if you don't expose your azure functions URL to the Internet, nobody would predict your Azure Functions URL. Even if they predict, the above mentioned things would be still applied. So don't worry! :)

P.S. You can't (and also shouldn't) hide/remove the .azurewebsites.net URL. It's using everywhere. From deploying your code to the health checks. It's everywhere. Also, you should create HealthChecks via Application Insights as well to check whether your function is health or not.

Mehmet Taha Meral
  • 3,315
  • 28
  • 30
  • Excellent answer @Mehmet. Thank you. I am indeed using KeyVault with a system-assigned managed identity to secure secrets. Will add the `AzureWebJobsDisableHomepage` app setting you mentioned. – SeaDude Jun 20 '20 at 03:14
  • Just adding on here... from a tin foil hat perspective, one should be careful with their Function App naming convention. The name and potentially its status (up/down) are publically visible at all times. – SeaDude Jun 20 '20 at 03:18
  • You are welcome mate - I'm glad it helped @SeaDude – Mehmet Taha Meral Jun 20 '20 at 10:40
0

One more option to make it more secure though would be to block all incoming IP addresses in Networking Tab: enter image description here

Add a role in Access Restrictions (e.g. Deny All for 0.0.0.0/0 -> meaning Deny All) and then anyone hitting the side will see the following: enter image description here

More Info on this can be found here: https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions

its for App Services, but concepts are same.

Sebs030
  • 566
  • 2
  • 4
  • 19