Setting up access control on Azure

Question

I am trying to set up access control on Azure so everything works off of the Managed Identity. I want to make sure I have this right because security is one of those things you never want to get wrong. So...

I first created a Managed Identity. In that Managed Identity, under Access control (IAM) | Role assignments it lists the users that are in this identity, with each having either a contributor or owner role. The managed identity is basically an indirect pointer to the collection of users/roles it has and those user/roles are then given rights via where the managed identity is set - correct?

I next went to my app service to Identity | User assigned and in there clicked Add and added my managed identity to the identity list for my app service. And because I am using the managed identity to let the app service access the database & key vault via the managed service, I do not want a system assigned identity - correct?

I next went to my SQL Server to Identity and in there clicked Add and added my managed identity to the identity list for my app service. I had to also set this as the Primary identity. And again, I don't want a system assigned identity here - correct?

Question: With the app service and SQL Database both having the same managed identity assigned, do I need to follow all these steps? Or is there a simple connection string that says use the shared managed identity?

In the key vault I went to Access control (IAM) and there it already had me listed individually. There is no Identity menu item. It has Add Role Assignment but there's no way to assign a managed identity in that - that I could see. And there's a ton of rights.

Question: How do I tell the Key Vault that my app service, with my managed identity, can read it?

And then, to use all this in my Blazor server app, I add the following code to Program.cs - correct?

Question: Just this and then anything in the key vault will override what's in the app service configuration and appsettings.json - correct?

public static IHostBuilder CreateHostBuilder(string[] args) =>
    Host.CreateDefaultBuilder(args)
        .ConfigureAppConfiguration((context, config) =>
        {
            if (context.HostingEnvironment.IsProduction())
            {
                var builtConfig = config.Build();
                var secretClient = new SecretClient(
                    new Uri($"https://{builtConfig["KeyVaultName"]}.vault.azure.net/"),
                    new DefaultAzureCredential());
                config.AddAzureKeyVault(secretClient, new KeyVaultSecretManager());
            }
        })
        .ConfigureWebHostDefaults(webBuilder => webBuilder.UseStartup<Startup>());

Answer 1

In the key vault I went to Access control (IAM) and there it already had me listed individually.

While creating the Azure KeyVault, when we select Permission model as Vault access policy, by default access Policies will be created with the name of the User with KeyVault Reader role , read-only permissions to access the Keys/Secrets/Certificates from the Key Vault.

There is no Identity menu item. It has Add Role Assignment but there's no way to assign a managed identity in that

• Identity menu will be available when you create a new Access Policy.

• You can create your own access policy and set the Managed Identity.
• Based on the selected template the permissions will be set.

• I have created a new Managed Identity with name HarshuMI,

You can see that is available under the Principal tab, while creating the new access policy.

anything in the key vault will override what's in the app service configuration and appsettings.json - correct?

Yes, the values which you have set in the appsettings.json will be overridden with the values from the Key Vaultwith your code.

How do I tell the Key Vault that my app service, with my managed identity, can read it?

As we have already set the Managed Identity in the above steps, we can now read the Key Vault Secrets without any issues.

Refer this SO Thread for more details.

Answer 2

I'm adding this as an answer so it's more obvious.

You need to install the NuGet package Azure.Extensions.AspNetCore.Configuration.Secrets (which is not documented anywhere). With that it works.

My code (it's working) is:

builder.Configuration.AddAzureKeyVault(
    new Uri("https://[your_host_name].vault.azure.net/"),
    new DefaultAzureCredential());