Chapter 6: Building Application Security

In the previous chapter, we explained how to manage and control user access through the use of management groups, policies, and Azure Blueprints.

In Chapter 2, Principles of Modern Architecture, we also discussed the need for security in depth – that is, the need for multiple layers of security to protect us in the event one layer is compromised.

Two such additional areas of control involve the encryption of data and the security of communications between services. This has become more important in recent years due to the increased use of microservice architectures that demand multiple smaller services, working together and transferring data between them.

Encryption of data is often performed using either SSL/TLS certificates or encryption keys and is applied while at rest or in transit.

Another data protection mechanism is how we control and authenticate between one system and another. One example is a website communicating with...

Technical requirements

This chapter will use the Azure portal (https://portal.azure.com) for examples, and Azure PowerShell (https://docs.Microsoft.com/en-us/powershell/azure/install-az-ps).

Coding is performed using Visual Studio Code, which can be downloaded here: https://code.visualstudio.com.

The source code for our examples can be downloaded from https://github.com/PacktPublishing/Exam-Ref-AZ-304-Microsoft-Azure-Architect-Design-Certification-and-Beyond/tree/master/ch6.

Introducing Azure Key Vault

Encrypting data in some form is a core requirement for many solutions; however, there are different ways we can encrypt data.

The most basic is encryption at rest. Storage services in Azure use encryption at rest by default – this includes Virtual Machine disks, storage accounts, and even SQL Server. To encrypt data, Azure uses Microsoft-managed keys; however, there is the option to use keys managed by yourself. When using customer-managed keys, you need to store them in a safe place that your services can access in a tightly controlled manner – because if you can get access to the keys, you can decrypt the data.

Important note

Data encryption at rest uses a key, a randomly generated set of bits used with a mathematical algorithm to scramble data. The same key is then used to decrypt (unscramble) the data. Much like a password, the length and complexity of the key determine its strength.

As well as encrypting data at rest, virtual machines...

Working with security principals

Security principals are used primarily for two scenarios: system access and identity integration.

System access is the ability for one system to access another and is closer to traditional methods for providing application or service access to other systems. A typical example is a database-specific username and password that an application would use to access the backend database.

One of the use cases for secret management in Key Vault is storing a database connection string containing the database username and password as a secret in the vault. However, we must first authenticate to the key vault for our application to access it, which can be performed using a username and password for the vault.

This may seem counter-intuitive, but in reality, this process helps protect our data. Security Principals in Azure can only be used programmatically; that is, you cannot use the credentials directly. It also allows one set of credentials to access multiple...

Using managed identities

In the previous section, we looked at working with security principals that can provide programmatic access to key vaults from our applications. There are a couple of problems with them – you must generate and provide a client ID and secret, and you must manage the rotation of those secrets yourself.

Managed identities provides a similar access option but is fully managed by Azure – there is no need to generate IDs or passwords; you set the appropriate access through role-based access controls. The managed identity mechanism can also be used to provide access to the following:

• Azure Data Lake
• Azure SQL
• Azure Storage (Blobs and Queues)
• Azure Analysis Services
• Azure Event Hubs
• Azure Service Bus

We have the option of using either a system-assigned or user-assigned identity. System-assigned is the easiest route – and is ideal for simple scenarios – but they are tied to the resource in question – that...

Summary

This chapter covered three tools in Azure that can help secure our applications, particularly around managing data encryption keys and authentication between systems.

We looked at how to use key vaults for creating and managing secrets and keys and how we can then secure access to them using Access policies. We also looked at how we can use security principals and managed identities to secure our applications.

This chapter also concluded the Identity and Security requirement of the AZ-304 exam, looking at authentication, authorization, system governance, and application-level security.

Next, we will look at how we architect solutions around specific Azure infrastructure and storage components.

Exam Scenario

The solutions to the exam scenarios can be found at the end of the book.

Mega Corp plans a new internal web solution consisting of a frontend web app, multiple middle-tier API apps, and a SQL database.

The database's data is highly sensitive, and the leadership team is concerned that providing database connection strings to the developers would compromise data protection laws and industry compliance regulations.

Part of the application includes the storage of documents in a Blob Storage account; however, the leadership team is not comfortable with Microsoft managing the encryption keys.

As this is an internal application, authentication needs to be integrated into the existing Active Directory. Also, each of the middle-tier services needs to know who the logged-in user is at all times – in other words, any authentication mechanism needs to pass through all layers of the system.

Design a solution that will alleviate the company's security concerns...

Further reading

You can check out the following links for more information about the topics that were covered in this chapter:

• Azure key vault: Azure Tags: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources
• Application Registrations: https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#guest-configuration
• Managed identities: https://docs.microsoft.com/en-us/azure/governance/blueprints/overview