CODEWITHSUNDEEP
c#.netazure
afeak
afeak

Reputation: 26

Secure an Azure AP Service hosting an API

I've created an API and deployed to Azure (be patient I'm new to all this). The API will be used by a single daemon app in another organisation. I'm planning to secure this by:

  1. IP White List - this seems to work an to my mind makes the API pretty damn secure.
  2. Client secret create by AAD - is this sufficient?
  3. HTTPs - I've turned this on (Azure APP service TLS blade). However it just seems to work which always makes me suspicious, do I need to link a certificate? Is the encryption being handled behind the scenes?

Upvotes: 1

Views: 42

Answers (1)

Thiago Custodio
Thiago Custodio

Reputation: 18387

If it's sufficient or not depends on your scenario. (e.g. is it hipaa / pci compliance?)

I would also add a Azure Key Vault for storing the secrets; WAF (Web Application Firewall) in front of the API + API Gateway (using API Management).

Your point #2 looks useless to me, you'd better request your client to authenticate against your azure Ad and pass the acquired token to your API. this way you'll know who / when called your service.

#3- Azure gives you a SSL certificate, but if you plain to use your custom domain (recommended), you could either generate a certificate using Let's Encrypt or buy from another trusted authority. The encryption happens at rest and in transit, but you could also use your encryption keys for the encryption at rest part.

Upvotes: 2

Related Questions