Azure serverless security

AZURE
SERVERLESS
SECURITY
P R A T I K K H A S N A B I S
A Z U R E C L O U D A R C H I T E C T ( M C S E & M C S D )
@ S O F T V E D A

SERVERLESS ARCHITECTURE
“Serverless architectures are application designs that
incorporate third-party “Backend as a Service” (BaaS) services,
and/or that include custom code run in managed, ephemeral
containers on a “Functions as a Service” (FaaS) platform. By
using these ideas, and related ones like single-page
applications, such architectures remove much of the need for
a traditional always-on server component. …”
- Martin Fowler
SPA App FaaS BaaS

SERVERLESS SECURITY
• Just because there is no servers to manage doesn’t absolve
you from the responsibility of securing your serverless
architecture.
• Security on cloud is everyone's responsibility including the
development team, the SRE/Ops team, Cyber Security team
and of course your cloud vendor.
• Security controls also depend on the threat model and risks
identified for your specific application. There is no one size fits
all solution to cyber security.

SECURING YOUR AZURE ACCOUNT
Your Pa$$word doesn't
matter
Enabling multi-factor authentication
(MFA) for accounts will end up blocking
99.9% of automated attacks.

APPSEC PRACTICES
Secure coding practices
Protect against OWASP Top 10
Do Input validation
Logging and Monitoring
Enable HTTPS only with TLS 1.2
Framework currency
Dependencies vulnerability scans
“UK cybersecurity
agency warns devs
to drop Python 2 due
to looming EOL &
security risks”
“Equifax breach was ‘entirely preventable’
had it used basic security measures, says
House report.
The credit agency failed to patch a disclosed
vulnerability in Apache Struts, a common
open source web server.”
“Backdoors snuck
into 12 OSS
packages were
downloaded
hundreds of
thousands of times.”

TYPICAL SERVERLESS ARCHITECTURE ON AZURE
Storage blob
Storage table Cosmos DB
API Management Functions
[Single Page App]
Serve static content (HTML,
CSS, JS, and image files)
directly from a storage
container named $web.
[REST API Gateway]
Serverless API management
with automated scaling for
securing, publishing, and
analysing APIs
[Backend - Microservice]
FaaS in Azure. An event-
driven serverless compute
platform
[Backend – Database]
NoSQL Databases in Azure
with almost limitless scaling

AZURE BLOBS – STATIC WEBSITE HOSTING
https://todoappinsecure.z13.web.core.windows.net/

TODO APP - SPA CODE
const azureFuncUrl = "https://todoinsecurefunctionapp.azurewebsites.net/api/todo/";
function callSearchAPi() {
var id = $("#searchInput").val();
$.ajax({
url: azureFuncUrl + id,
type: "GET
…
}
$("#searchBtn").click(function () {
clearErrorMessage();
callSearchAPi();
})

TODO FUNCTION
https://todoinsecurefunctionapp.azurewebsites.net/api/todo/{id}

TODO TABLE STORAGE
Connection String in Function App Application Settings

IS THIS APP SECURE?
Storage blob
Functions
[Single Page App]
platform
App
Config

PROBLEM STATEMENT
How do we make sure that the REST API calls from the SPA to
Azure Function is secure as in only authenticated and
authorised users can invoke the Azure Function.
How do we make sure that only the Azure Function app can
access the backend Database and secure the credential.

REGISTER TODO API FUNCTION IN AZURE AD

CHANGE AUTHENTICATION TO FUNCTION

AZURE API MANAGEMENT
• Reducing the attack surface
• CORS Policy
• Validate JWT Policy
• Rate limiting

PUBLISH TODO FUNCTION APP IN AZURE APIM

IS THIS APP SECURE?
Storage blob
[Single Page App]
[REST API Gateway]
analysing APIs
platform
JWT Key App
Config

ADD APPLICATION ROLE IN MANIFEST

GRANT APPLICATION ROLE TO USER

IS THIS APP SECURE?
Storage blob
[Single Page App]
[REST API Gateway]
analysing APIs
platform
JWT
Key
App
Config
JWT

CREDENTIAL FREE CODE
Managed Identity for Azure Resources (aka MSI)
– MSI_ENDPOINT
– MSI_SECRET

CREATE AN IDENTITY FOR THE FUNCTION APP

SAVE CONNECTION STRING AS A SECRET IN KV

SET A LEAST PRIVILEGE ACCESS POLICY TO THE
FUNCTION APP IDENTITY

SET THE CONNECTION STRING VALUE IN FUNCTION
APP APPLICATION SETTINGS
Format is
@Microsoft.KeyVault(SecretUri=secret_uri_with_version)

IS THIS APP SECURE?
Storage blob
[Single Page App]
[REST API Gateway]
analysing APIs
platform
JWT
Key
MSI
JWT

SECURE SERVERLESS ARCHITECTURE
Azure
Active Directory
Azure Key Vault
API Management
Storage blob
Static Website
Hosting
Sign In
Open-id config
MSI Access Policy
GET Static Assets
(Unauthenticated)
AJAX API Calls API Calls Table Ops
GET Secret
SPA App
(ADAL.js)
Storage table
CORS policy
Validate JWT policy
Validate Claims
JWT JWTFunction
Key
Get Access
Token
Data Store
JWT

TAKEAWAYS
• Implement OAUTH 2.0 Implicit Flow in the SPA to get a access token for the Function App
being called
• Register the SPA and the Function App in Azure AD as applications
• Change Function App application manifest and add “app roles”
• Grant roles to users in AD for the Function App application
• Publish the Function App in Azure API Management
• Validate the JWT token in APIM policy
• Check the role in the claims within the JWT in Function App code
• Set Managed Identity for the Function App
• Stote connection strings as secrets in Azure Key Vault
• Grant least privilege access policy to the Function App MSI in the Key Vault
• Change the application configuration for Function App to point to Key Vault

THANK YOU
Pratik Khasnabis
Azure Cloud Architect (MCSE & MCSD)
@softveda

Azure serverless security

More Related Content

What's hot (7)

Similar to Azure serverless security (20)

Recently uploaded (20)

Azure serverless security

Editor's Notes