CODEWITHSUNDEEP
azureazure-blob-storageazure-web-app-service
Henry Stratton
Henry Stratton

Reputation: 23

Limit Azure Blob Access to WebApp

Situation: We have a web-app on azure, and blob storage, via our web-app we write data into the blob, and currently read that data back out returning it as responses in the web-app.

What we're trying to do: Trying to find a way to restrict access to the blob so that only our web-app can access it. Currently setting up an IP address in the firewall settings works fine if we have a static IP (we often test running the web app locally from our office and that lets us read/write to the blob just fine). However when we use the IP address of our web app (as read from the cross domain page of the web app) we do not get the same access, and get errors trying to read/write to the blob.

Question: Is there a way to restrict access to the blob to the web app without having to set up a VPN on azure (too expensive)? I've seen people talk about using SAS to generate time valid links to blob content, and that makes sense for only allowing users to access content via our web-app (which would then deliver them the link), but that doesn't solve the problem of our web-app not being able to write to the blob when not publicly accessible.

Are we just trying to miss-use blobs? or is this a valid way to use them, but you have to do so via the VPN approach?

Upvotes: 2

Views: 1321

Answers (2)

juunas
juunas

Reputation: 58773

Another option would be to use Azure AD authentication combined with a managed identity on your App Service. At the time of writing this feature is still in preview though.

I wrote on article on how to do this: https://joonasw.net/view/azure-ad-authentication-with-azure-storage-and-managed-service-identity.

The key parts:

  • Enable Managed Identity
  • Add the generated service principal the necessary role in the storage account/blob container
  • Change your code to use AAD access tokens acquired with the managed identity instead of access key/SAS token

Acquiring the token using https://www.nuget.org/packages/Microsoft.Azure.Services.AppAuthentication/1.1.0-preview:

private async Task<string> GetAccessTokenAsync()
{
    var tokenProvider = new AzureServiceTokenProvider();
    return await tokenProvider.GetAccessTokenAsync("https://storage.azure.com/");
}

Reading a blob using the token:

private async Task<Stream> GetBlobWithSdk(string accessToken)
{
    var tokenCredential = new TokenCredential(accessToken);
    var storageCredentials = new StorageCredentials(tokenCredential);
    // Define the blob to read
    var blob = new CloudBlockBlob(new Uri($"https://{StorageAccountName}.blob.core.windows.net/{ContainerName}/{FileName}"), storageCredentials);
    // Open a data stream to the blob
    return await blob.OpenReadAsync();
}

Upvotes: 2

Mehdi Ibrahim
Mehdi Ibrahim

Reputation: 2624

SAS Keys is the correct way to secure and grant access to your Blob Storage. Contrary to your belief, this will work with a private container. Here's a resource you may find helpful:

http://www.siddharthpandey.net/use-shared-access-signature-to-share-private-blob-in-azure/

Please also review Microsoft's guidelines on securing your Blob storage. This addresses many of the concerns you outline and is a must read for any Azure PaaS developer:

https://learn.microsoft.com/en-us/azure/storage/common/storage-security-guide

Upvotes: 1

Related Questions