Skip to content

Commit 3089c23

Browse files
msftrubengumsftrubengu
authored
Use managed identities for AzureWebJobsStorage (microsoft#239)
This change removes the use of the Storage Account connection string in Azure Funcions for AzureWebJobsStorage. This is not a full move to managed identities because WEBSITE_CONTENTAZUREFILECONNECTIONSTRING still doesn't support them.
1 parent bf75b11 commit 3089c23

15 files changed

+227
-4
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ bld/
3131
[Ll]og/
3232
[Ll]ogs/
3333

34+
!scripts/Release/
35+
3436
# These are the PowerShell helper libraries used to run. Added to artifact as automated task
3537
Tools/PowershellModule/src/Library/ARMTemplate
3638
Tools/PowershellModule/src/Library/RestAPI

‎scripts/Release/service_principals_roles.ps1

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<#
2+
.SYNOPSIS
3+
Sets roles to a service principals
4+
.DESCRIPTION
5+
Sets roles to service principals given a json file with the definitions.
6+
#>
7+
Param(
8+
[Parameter(Mandatory=$true)]
9+
[String]
10+
$subscriptionId,
11+
12+
[Parameter(Mandatory=$true)]
13+
[String]
14+
$resourceGroup,
15+
16+
[Parameter(Mandatory=$true)]
17+
[String]
18+
$rolesFile,
19+
20+
[Switch]
21+
$showWarnings
22+
)
23+
24+
Set-AzContext -SubscriptionId $subscriptionId | Out-Null
25+
$local:data = Get-Content $rolesFile -Raw | ConvertFrom-Json
26+
27+
foreach ($storageAccount in $data.storageAccounts)
28+
{
29+
$private:scope = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroup/providers/Microsoft.Storage/storageAccounts/$($storageAccount.name)"
30+
31+
foreach ($sp in $storageAccount.servicePrincipals)
32+
{
33+
Write-Host "Configuring $($sp.displayName) in $($storageAccount.name)"
34+
$private:objectId = (Get-AzADServicePrincipal -DisplayName $($sp.displayName)).Id
35+
36+
if ($null -eq $objectId)
37+
{
38+
Write-Error "Cannot find $($sp.displayName)"
39+
continue
40+
}
41+
42+
$private:currentRoles = Get-AzRoleAssignment -ObjectId $objectId -Scope $scope
43+
foreach ($role in $sp.roles)
44+
{
45+
$private:exists = $currentRoles | Where-Object { $_.RoleDefinitionName -eq $role }
46+
if ($null -eq $exists)
47+
{
48+
New-AzRoleAssignment -ObjectID $objectId -RoleDefinitionName $role -Scope $scope
49+
}
50+
else
51+
{
52+
if ($showWarnings)
53+
{
54+
Write-Warning "$($sp.displayName) already has '$role' assigned to $($storageAccount.name)"
55+
}
56+
}
57+
}
58+
}
59+
}

‎src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.int.centus.json

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
],
5252
"supportCredentials": false
5353
}
54+
},
55+
"azFuncStorageName": {
56+
"value": "stwgrestcentusint"
5457
}
5558
}
5659
}

‎src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.int.westus.json

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
],
5252
"supportCredentials": false
5353
}
54+
},
55+
"azFuncStorageName": {
56+
"value": "stwgrestwestusint"
5457
}
5558
}
5659
}

‎src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.pme.centus.json

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
],
5252
"supportCredentials": false
5353
}
54+
},
55+
"azFuncStorageName": {
56+
"value": "stwgrestcentuspme"
5457
}
5558
}
5659
}

‎src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.pme.westus.json

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
],
5252
"supportCredentials": false
5353
}
54+
},
55+
"azFuncStorageName": {
56+
"value": "stwgrestwestuspme"
5457
}
5558
}
5659
}

‎src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.ppe.centus.json

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
],
5252
"supportCredentials": false
5353
}
54+
},
55+
"azFuncStorageName": {
56+
"value": "stwgrestcentusppe"
5457
}
5558
}
5659
}

‎src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.ppe.westus.json

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
],
5252
"supportCredentials": false
5353
}
54+
},
55+
"azFuncStorageName": {
56+
"value": "stwgrestwestusppe"
5457
}
5558
}
5659
}

‎src/WinGet.RestSource.Infrastructure/Parameters/AzureFunction/azurefunction.test.westus.json

+3
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@
4040
},
4141
"monitoringMetricsAccount": {
4242
"value": "MsPkgMgrMetrics"
43+
},
44+
"azFuncStorageName": {
45+
"value": "stwgrestwestustest"
4346
}
4447
}
4548
}

‎src/WinGet.RestSource.Infrastructure/Parameters/KeyVault/keyvault.test.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
},
3232
{
3333
"tenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
34-
"objectId": "94068ac3-3b3c-4ce5-8f6d-b0ec26875e07",
34+
"objectId": "789c9442-e61d-48ea-84e1-02892ef4651f",
3535
"permissions": {
3636
"keys": [
3737
"Get",
@@ -51,7 +51,7 @@
5151
]
5252
},
5353
"metadata": {
54-
"description": "This is the object for DEP-APT-WinGetService-Test (winget-cli-restsource)."
54+
"description": "This is the object for winget-cli-restsource Test."
5555
}
5656
},
5757
{

‎src/WinGet.RestSource.Infrastructure/Parameters/Roles/roles.int.json

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"storageAccounts": [
3+
{
4+
"description": "This is the storage account for the west azure function",
5+
"name": "stwgrestwestusint",
6+
"servicePrincipals": [
7+
{
8+
"displayName": "azfun-wgrest-api-westus-int",
9+
"roles": [
10+
"Storage Account Contributor",
11+
"Storage Blob Data Owner",
12+
"Storage Table Data Contributor",
13+
"Storage Queue Data Contributor",
14+
"Storage Queue Data Message Sender",
15+
"Storage Queue Data Message Processor"
16+
]
17+
}
18+
]
19+
},
20+
{
21+
"description": "This is the storage account for the central us azure function",
22+
"name": "stwgrestcentusint",
23+
"servicePrincipals": [
24+
{
25+
"displayName": "azfun-wgrest-api-centus-int",
26+
"roles": [
27+
"Storage Account Contributor",
28+
"Storage Blob Data Owner",
29+
"Storage Table Data Contributor",
30+
"Storage Queue Data Contributor",
31+
"Storage Queue Data Message Sender",
32+
"Storage Queue Data Message Processor"
33+
]
34+
}
35+
]
36+
}
37+
]
38+
}

‎src/WinGet.RestSource.Infrastructure/Parameters/Roles/roles.pme.json

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"storageAccounts": [
3+
{
4+
"description": "This is the storage account for the west azure function",
5+
"name": "stwgrestwestuspme",
6+
"servicePrincipals": [
7+
{
8+
"displayName": "azfun-wgrest-api-centus-pme",
9+
"roles": [
10+
"Storage Account Contributor",
11+
"Storage Blob Data Owner",
12+
"Storage Table Data Contributor",
13+
"Storage Queue Data Contributor",
14+
"Storage Queue Data Message Sender",
15+
"Storage Queue Data Message Processor"
16+
]
17+
}
18+
]
19+
},
20+
{
21+
"description": "This is the storage account for the central us azure function",
22+
"name": "stwgrestcentuspme",
23+
"servicePrincipals": [
24+
{
25+
"displayName": "azfun-wgrest-api-westus-pme",
26+
"roles": [
27+
"Storage Account Contributor",
28+
"Storage Blob Data Owner",
29+
"Storage Table Data Contributor",
30+
"Storage Queue Data Contributor",
31+
"Storage Queue Data Message Sender",
32+
"Storage Queue Data Message Processor"
33+
]
34+
}
35+
]
36+
}
37+
]
38+
}

‎src/WinGet.RestSource.Infrastructure/Parameters/Roles/roles.ppe.json

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"storageAccounts": [
3+
{
4+
"description": "This is the storage account for the west azure function",
5+
"name": "stwgrestwestusppe",
6+
"servicePrincipals": [
7+
{
8+
"displayName": "azfun-wgrest-api-westus-ppe",
9+
"roles": [
10+
"Storage Account Contributor",
11+
"Storage Blob Data Owner",
12+
"Storage Table Data Contributor",
13+
"Storage Queue Data Contributor",
14+
"Storage Queue Data Message Sender",
15+
"Storage Queue Data Message Processor"
16+
]
17+
}
18+
]
19+
},
20+
{
21+
"description": "This is the storage account for the central us azure function",
22+
"name": "stwgrestcentusppe",
23+
"servicePrincipals": [
24+
{
25+
"displayName": "azfun-wgrest-api-centus-ppe",
26+
"roles": [
27+
"Storage Account Contributor",
28+
"Storage Blob Data Owner",
29+
"Storage Table Data Contributor",
30+
"Storage Queue Data Contributor",
31+
"Storage Queue Data Message Sender",
32+
"Storage Queue Data Message Processor"
33+
]
34+
}
35+
]
36+
}
37+
]
38+
}

‎src/WinGet.RestSource.Infrastructure/Parameters/Roles/roles.test.json

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"storageAccounts": [
3+
{
4+
"description": "This is the storage account for the west azure function",
5+
"name": "stwgrestwestustest",
6+
"servicePrincipals": [
7+
{
8+
"displayName": "azfun-wgrest-api-westus-test",
9+
"roles": [
10+
"Storage Account Contributor",
11+
"Storage Blob Data Owner",
12+
"Storage Table Data Contributor",
13+
"Storage Queue Data Contributor",
14+
"Storage Queue Data Message Sender",
15+
"Storage Queue Data Message Processor"
16+
]
17+
}
18+
]
19+
}
20+
]
21+
}

‎src/WinGet.RestSource.Infrastructure/Templates/AzureFunction/azurefunction.json

+8-2
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,13 @@
6868
"storageSecretName": {
6969
"type": "string",
7070
"metadata": {
71-
"description": "Storage Secret Name"
71+
"description": "Storage Secret Name. TODO: delete this once WEBSITE_CONTENTAZUREFILECONNECTIONSTRING managed identity support is enabled"
72+
}
73+
},
74+
"azFuncStorageName": {
75+
"type": "string",
76+
"metadata": {
77+
"description": "The name of the storage account used for Az Func operations. This Az Func must have the permissions required. See roles.*.json under StorageAccount"
7278
}
7379
},
7480
"appInsightSubscription": {
@@ -245,7 +251,7 @@
245251
"properties": {
246252
"APPINSIGHTS_INSTRUMENTATIONKEY": "[reference(variables('appInsightResourceId'), '2015-05-01').InstrumentationKey]",
247253
"AzFuncRestSourceEndpoint": "[concat('@Microsoft.KeyVault(SecretUri=', variables('kv_secreturi_path'), variables('kv_restSourceApiEndpoint_SecretName'), '/)')]",
248-
"AzureWebJobsStorage": "[concat('@Microsoft.KeyVault(SecretUri=', variables('kv_secreturi_path'), parameters('storageSecretName'), '/)')]",
254+
"AzureWebJobsStorage__accountName": "[parameters('azFuncStorageName')]",
249255
"CertificateAuthenticationRequired": "[variables('certificateAuthenticationEnabled')]",
250256
"CertificateAuthenticationSelfSigned": "[parameters('certificateAuthenticationAllowSelfSigned')]",
251257
"CertificateAuthenticationSubjectName": "[parameters('certificateAuthenticationSubjectName')]",

0 commit comments

Comments
 (0)