Harden Azure Functions with Managed Identity
Long-term client secrets are not a good solution whenever we can avoid them. In this lab, you'll harden a Node.js Azure Functions API by replacing its client secret with a system-assigned managed identity. You'll use that identity to access Microsoft Foundry and private Blob runbooks, make sure the application still works, and then disable storage account key access.
- 6 guided tasks
Scenario
The currently deployed CloudOps API uses a long-lived client secret to authenticate with Foundry and Blob Storage. We want to avoid long-term secrets whenever possible, because if it leaks, someone else can use it until it expires or we revoke it.
Let's replace that secret with an Azure-managed workload identity. Azure will issue short-lived access tokens when the API needs to call each service. The application will no longer need to store or rotate a client secret.
If you're coming from AWS, this is similar to assigning an IAM role to a workload instead of storing long-lived access keys. AWS provides temporary role credentials, while Azure provides access tokens for the managed identity.
- Your Manager
What you will learn
- Compare an Azure Function managed identity with an AWS Lambda execution role
- Inspect a Function identity and its application settings in the Azure portal
- Replace client-secret authentication with one shared ManagedIdentityCredential
- Deploy a linked Flex Consumption Function without exposing its direct endpoint
- Disable storage shared-key access and validate the approved identity path
Harden Azure Functions with Managed Identity
Included in Cybr Premium.