Securing an Azure Function

Question

I'm trying to apply the least privilege principle to an Azure Function. What I want is to make a FunctionApp have only read access to a, for example, storage queue. What I've tried so far is:

• Enable managed identity in the FunctionApp
• Create a role that only allows read access to the queues (role definition below)
• Go to the storage queue IAM permissions, and add a new role assignment, using the new role and the Function App.

But it didn't work. If I try to write to that queue from my function (using an output binding) the item is written, when I expected a failure. I've tried using the builtin role "Storage Queue Data Reader (Preview)" with the same result.

What's the right way to add/remove permissions of a Function App?

Role definition:

{
  "Name": "Reader WorkingSA TestQueue Queue",
  "IsCustom": true,
  "Description": "Read TestQueue queue on WorkingSA storage accoung.",
  "actions": ["Microsoft.Storage/storageAccounts/queueServices/queues/read"],
  "dataActions": [
    "Microsoft.Storage/storageAccounts/queueServices/queues/messages/read"
  ],
  "notActions": [],
  "notDataActions": [],
  "AssignableScopes": [
    "/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/TestAuth-dev-rg"
  ]
}

Answer 1

@anirudhgarg has pointed the right way.

The managed identity and RBAC you set makes difference only when you use managed identity access token to reach Storage service in Function app. It means those settings have no effect on function binding as it internally connects to Storage using connection string. If you haven't set connection property for the output binding, it leverages the AzureWebJobsStorage app settings by default.

To be more specific, connection string has nothing to do with Azure Active Directory Authentication process so it can't be influenced by AAD configuration. Hence if a function takes advantage of Storage Account connection string(e.g. uses Storage related binding), we can't limit its access with other settings. Likewise, no connection string usage means no access.

Update for using SAS token

If the queue mentioned is used in a Queue Trigger/input binding, we can restrict function with read and process(get message then delete)access, here comes SAS token.

Prerequisite:

1. Queue locates at Storage account other than the one specified by AzureWebJobsStorage app setting. AzureWebJobsStorage requires connection string offering full access with Account key.

2. Function app is 2.0. Check it on Function app settings> Runtime version: 2.xx (~2). In 1.x it requires more permissions like AzureWebJobsStorage.

Then get SAS token on portal as below and put it in app settings.