Securing Azure SQL Databases

In the previous chapter, we covered recipes for protecting the integrity of Azure VMs by ensuring that they were updated, antimalware was enabled, and disks were encrypted disks.

With public cloud provider platforms, the shared responsibility model means that while the provider is responsible for providing security and control mechanisms of the platform hosting that data that can be enabled, the customer is always responsible for correctly implementing and configuring those controls and ensuring appropriate governance and operations.

To avoid doubt, it is critical to call out that the customer is always responsible for the data stored on those platforms and its operation.

We can use an analogy of a rented property and your relationship with the landlord. While the landlord will be responsible for providing doors and windows and the controls such as locks, alarms, and a gated entrance for vehicle access with CCTV to monitor the property, you are...

Technical requirements

For this chapter, it is already assumed that you have an Azure AD tenancy and an Azure subscription from completing the recipes in previous chapters of this cookbook. If you skipped straight to this section, the information to create a new Azure AD tenancy and an Azure subscription for these recipes is included in the following list of requirements.

For this chapter, the following are required for the recipes:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal.azure.com
• An Azure AD tenancy and Azure subscription; you may use an existing one or sign up for free: https://azure.microsoft.com/en-us/free
• An Owner role for the Azure subscription

Implementing a service-level IP firewall

In many workload scenarios, the first line of protection in a defense-in-depth approach to security is a network layer firewall to act as a layer 3 network traffic packet filter.

This recipe will teach you how to restrict network access to your Azure SQL database. We will configure rules for the native Azure service-level IP firewall service to protect your Azure databases.

Getting ready

This recipe requires the following:

• A device with a browser, such as Edge or Chrome, to access the Azure portal: https://portal.azure.com
• Access to an Azure subscription, where you have access to the Owner role for the Azure subscription
• Access to an Azure SQL database; we will step through this process in the following Getting ready tasks

Continue with the following Getting ready tasks for this recipe:

• Creating an Azure SQL database

Getting ready task – creating an Azure SQL database

Perform the following...

Implementing a private endpoint

One of the foundations of securing resources is to reduce the attack surface area and minimize exposure to public network access.

Azure PaaS services’ inherent nature and concern are that they have public endpoints, which means any vulnerabilities are exposed and can be exploited. One of the best practices we should follow in our security model for cloud services is to limit public access to resources wherever possible and adopt a network model where private IP addressing is used wherever possible.

Azure Private Link is an Azure service that enables you to connect to public endpoint PaaS services such as Azure SQL database and Azure Storage from an Azure virtual network.

Using the Private Link capability, you can privately connect to a PaaS service by creating a private endpoint (in place of a public endpoint) to connect to.

The PaaS service endpoint is never exposed to the internet, and traffic to and from the service never traverses...

Implementing Azure AD authentication and authorization

With cloud-based implementations of databases such as Azure SQL, we can centrally manage, control, and protect the identities of users who access the databases when we use the Azure Active Directory (Azure AD) Cloud Identity Provider service.

Microsoft provides Azure AD as a fully managed Identity Provider (IDP) platform provided as Software-as-a-Service (SaaS). Its primary function is to manage and control resource access through Authentication and Authorization.

Azure AD provides a mechanism to centrally authenticate users/groups for admin access to an Azure SQL database, without requiring local database accounts.

This recipe will teach you how to implement a centralized, controlled, and secure access management method for connecting to your Azure SQL databases using Azure AD authentication in place of local database accounts.

Getting ready

This recipe requires the following:

• A device with a browser, such...