jandev / secure-apis Goto Github PK

Project containing samples for using managed identities and authorizing services using these identities

License: MIT License

C# 70.73% PowerShell 29.27%

secure-apis's Introduction

My Secure APIs demo project

This project contains some of the best-practices, known to me, for securing your web applications in Azure.
It's a work-in-progress, so nowhere near perfect.

Goals

The things I want to do in this project.

Have an access restriction on the backend services, only to allow traffic from within the VNet
VNet integrate the frontend service (API) to communicate with the backend services (Speaker API & Conference API)
Have authentication & authorization in place on backend services
Only the frontend service (API) can communicate with the backend services Handled via app roles assigned to managed identity
Use Key Vault references for accessing secrets
Get & assign keys & connection strings via ARM Template functions during deployment
Use and assign RBAC roles for managed identities to allow access to other resources
Create and assign Azure Policies for compliancy of the resource group
...

Want to help?

If you think something is missing from my list or think of something else, feel free to add new issues.
I'm using this project as a learning exercise and would love to learn more from you.

Badges

secure-apis's People

Contributors

Stargazers

Watchers

Forkers

humbertocabezas vighneshkoparkar laurachristensen1214

secure-apis's Issues

Add authorization on Conferences API

Just like in the Speaker API, add the authorization to the Conferences API.

This is probably some code which needs to be added in the Startup and configuration. Of course, it also needs the settings being added in the ARM template.

Add VNet integration for the Speaker API

Just like the Conferences API, the Speaker API needs to be VNet integrated also.

This should only be a change in the ARM template.

Add databases to the backend api's

The Speaker & Conferences API's now keep their state using an in-memory list.

It would be better to use something else for this. My suggestion is to use the Serverless offering of Cosmos DB for this to keep costs to a minimum.
Connecting to it should be done by using the managed identity of the App Service.

Use linked templates for deployment

It will make the ARM template much more readable & reusable.

Also, use the copy() function to deploy the App Services and split the appSettings and other config stuff from the App Service deployment template.

Update the readme with the project goals

Describe what you want to do in this project, how it works and how to set it up for yourself.

Add GitHub Action to deploy everything to Azure

The API's should be deployed the their respective App Services
The Azure Functions (workers) should be deployed to their respective Function Apps.

Everything should be deployed via the ARM templates in this repository. The complete solution is being deployed via Azure DevOps now, but has to be migrated over here.

Https Only on all sites

Only allow HTTPS traffic and at least TLS1.2.

Can be handled via ARM template.

Add a script to create App Registrations and Service Principals

The Speaker API & Conferences API are using configuration settings from an App Registration inside the Azure Active Directory.

A script should be added to the create these App Registrations.
Also, the front-end API needs to be granted a role (Reader and/or Writer) to the Speaker- & Conferences API. I also want this to be in the script, or in a different script if you prefer.

Some work has already been done in the branch https://github.com/Jandev/secure-apis/tree/feature/creating-app-registrations-in-script but needs to be finished accordingly.