Securing App Development with Managed Identities and Role-Based Access Control
Published: 2024-05-29 21:36:54

The company is designing and developing a new app, requiring secure storage access using keys and managed identities. Developers aim to implement role-based access control and need protected immutable storage for testing.

Our goals are as follows:

- Create the storage account and managed identity.
- Secure access to the storage account using a key vault and key.
- Configure the storage account to use the customer-managed key in the key vault.
- Set up a time-based retention policy and an encryption scope.


Create the storage account and managed identity
Provide a storage account for the web app.
In the portal, search for and select Storage accounts.

![select Storage accounts](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e93kszqomkwkej627h2x.png)
Select + Create.
![Select + Create.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gzx8sbm703darxwb7gd2.png)

For Resource group select Create new. Give your resource group a name and select OK to save your changes.
![Resource group select Create new](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5yyy43i5aef751lthnwn.png)

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.
![Storage account name](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9ycgtczo64gqpl3q2rsm.png)

Move to the Encryption tab.
Check the box for Enable infrastructure encryption.
Notice the warning, This option cannot be changed after this storage account is created.
![Enable infrastructure encryption](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/owxm1r7y07xg1vdagt67.png)

Select Review + Create.
![Select Review + Create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dkfsg58hehq1e92bv14e.png)
![Create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3407jbntlbc1s1zsq7fz.png)

Wait for the resource to deploy.
![deploy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dgjz3rx4dkagxh99xabe.png)


Provide a managed identity for the web app to use. 
Search for and select Managed identities.
![managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e71ijumn4f3oqaoskstj.png)

Select Create.
![Select Create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fj1f5eebwx976a7szuq3.png)

Select your resource group.
![resource group](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2xqc3u92m75murvros35.png)

Give your managed identity a name.
![managed identity a name](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f2uz16rserehgalcnefy.png)

Select Review and create, and then Create.
![Select Review and create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5pqocdck5065qywmf3kf.png)
![Create.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gcnf6w5zagxu3rjf4pki.png)


Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs. 

Search for and select your storage account.
![select your storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9hnkyu59z0mk0e28k4b8.png)
![your storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sacrehkaw89w8nb7r94l.png)

Select the Access Control (IAM) blade.
![Access Control (IAM) blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/00851j0uhrmd2p42socl.png)

Select Add role assignment (center of the page).
![Add role assignment ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/76ugnsvb1n7smrenp45z.png)

On the Job functions roles page, search for and select the Storage Blob Data Reader role.
![Job functions roles page](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/31pyc3t9h8eb15x8jqj9.png)
![select the Storage Blob Data Reader role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/infpszscnoit2nssg5tg.png)

On the Members page, select Managed identity.
![select Managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ihz6qpxnj2lj6htzqrdm.png)

Select Select members, in the Managed identity drop-down select User-assigned managed identity.
![User-assigned managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gu37k4d5xsw2cdo86zqn.png)

Select the managed identity you created in the previous step.
![managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3vaq4nsfdlorw37xf1gz.png)

Click Select and then Review + assign the role.
Select Review + assign a second time to add the role assignment.
![Select ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/atq3t5lp4jwicbhso6t9.png)
![Review + assign](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5hpjhv4rup6cepdf8fyt.png)

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.
![storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u99liy8wmm75r8mp0pbq.png)


Secure access to the storage account with a key vault and key
To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. 


In the portal, search for and select Resource groups.
![select Resource groups](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pu4xpjum4gacatq51niw.png)

Select your resource group, and then the Access Control (IAM) blade.
![Access Control (IAM) blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tj7e15hj2mkfkhs1gnnt.png)

Select Add role assignment (center of the page).
![Add role assignment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eceqka7p0w7j62xy7v5k.png)

On the Job functions roles page, search for and select the Key Vault Administrator role.
![Job functions roles page](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/li90yy7s0gen6gbgim3b.png)
![Key Vault Administrator role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/23jeo8w1ph76i4is6uz8.png)

On the Members page, select User, group, or service principal.
![User, group, or service principal](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k9r6nthuxwe8bdnitoux.png)

Select Select members.
![Select members](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vpnu2tedhk8urv5o9rwl.png)

Search for and select your user account. Your user account is shown in the top right of the portal.
![user account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6fd0v5v54c48wrbb2asn.png)

Click Select and then Review + assign.
![Select](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/va5ueiss4oi6gg7kpzlz.png)
![Review + assign](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d5rz8w56wu3nbeqxc8a6.png)

Select Review + assign a second time to add the role assignment.
![Review + assign a second time](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w2mu4sq1y1xwnrfywnbh.png)

You are now ready to continue with the lab.
![continue with the lab](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rep4xqdm1jblj8spucg8.png)


Create a key vault to store the access keys.

In the portal, search for and select Key vaults.
Select Create.
![select Key vaults](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1uxap4fijlja00crh52p.png)
![Select Create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xf65x9ditzsj8be4rgly.png)

Select your resource group.
![Select your resource group](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7vj27nrfc4ibqflhike5.png)

Provide the name for the key vault. The name must be unique.
![name for the key vault](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2chr8lngcsn0u5uuprvy.png)

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.
![Azure role-based access control](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cqet0czkn4v8suib98a8.png)

Select Review + create.
![Review + create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3h3rttgjl18wcixyv047.png)

Wait for the validation checks to complete and then select Create.
![checks to complete and then select Create.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bj20py8oujkwum1bidwe.png)

After the deployment, select Go to resource.
![Go to resource](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oxgjco2hod5d56lpxrm0.png)

On the Overview blade ensure both Soft-delete and Purge protection are enabled.
![Soft-delete and Purge protection are enabled.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cllphpm9w2iy8wps5siu.png)


Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.
![Keys blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/st06lbc7qyqgn7lwnv81.png)

Select Generate/Import and Name the key.
![Generate/Import](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jf0nrrhswaqujp5hyt4o.png)
![Name the key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5onlr4qvxul7ic0jtvqj.png)

Take the defaults for the rest of the parameters, and Create the key.
![Create the key.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/czgw33ywyrcba9si5wck.png)


Configure the storage account to use the customer managed key in the key vault
Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity. 

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
![Access Control (IAM) blade.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6rr2bar3kmgwg8rr0ctt.png)

Select Add role assignment (center of the page).
![Add role assignment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1200yasm5gaikeo9aiaa.png)

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.
![select the Key Vault Crypto Service Encryption User role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7560dvk5x84ixphd8kpc.png)

On the Members page, select Managed identity.
![Managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0hmza98q68k9w50t6p42.png)

Select Select members, in the Managed identity drop-down select User-assigned managed identity.
![User-assigned managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/liyxkeopxupozygmv9rd.png)

Select your managed identity.
![managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/plaf12rs2wpx92gwih14.png)

Click Select and then Review + assign.
![Select](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z9n7wzpgtbm02eptw7d2.png)
![Review + assign](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pc1nirorcd5msexey4ph.png)

Select Review + assign a second time to add the role assignment.
![Review + assign](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gl8vik4d45wfoi0tca7u.png)


Configure the storage account to use the customer managed key in your key vault. Learn more about customer managed keys on an existing storage account.

Return to your the storage account.
![storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y784tfvq3jru6zbi1cho.png)

In the Security + networking section, select the Encryption blade.
![Encryption blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/moy18ozkoe52bmfzqne4.png)

Select Customer-managed keys.
![Customer-managed keys](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zz1tlayuxo8kalc5cp1c.png)

Select a key vault and key. Select your key vault and key.
![Select a key vault](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5us1hvk98uksibq58g89.png)
![key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ly1tp7jao0pluphd6mxl.png)
![your key vault and key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cwwx9dnrn32g70p3g12o.png)

Select to confirm your choices.
![Select](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0phnnfhr602bbrcprdp0.png)

Ensure the Identity type is User-assigned.
![User-assigned](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kq5cqtrx43peq6de87ww.png)

Select an identity.
![Select an identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sxyx4pzjmegjd4d0t8ke.png)

Select your managed identity then select Add.
![managed identity ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mh7ufvlljg4szg8g9kyn.png)

Save your changes.
![Save your changes](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zeyxho09rqqd3y9okcau.png)

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.


Configure an time-based retention policy and an encryption scope.
The developers require a storage container where files can’t be modified, even by the administrator.

Navigate to your storage account.
In the Data storage section, select the Containers blade.
![Navigate to your storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/accjnzoqspyu9ejw6kr7.png)

Create a container called hold. Take the defaults. Be sure to Create the container.
![Create a container called hold](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0licizhixnai0179okqa.png)

Upload a file to the container.
![Upload a file](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xfzu95vaymxf120iwiqb.png)

In the Settings section, select the Access policy blade.
![Access policy blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t4u69jf4rd9m9pxpt84q.png)

In the Immutable blob storage section, select + Add policy.
![select + Add policy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9bhas2amxqnxwzdwlp33.png)

For the Policy type, select time-based retention.
![select time-based retention](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8l4bwutkuknxrp49lw0l.png)

Set the Retention period to 5 days.
Be sure to Save your changes.
![Retention period](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cy7lbigcp2fsx7cvwxsy.png)

Try to delete the file in the container.
Verify you are notified failed to delete blobs due to policy.
The developers require an encryption scope that enables infrastructure encryption. 
![infrastructure encryption.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e5mzy4zsh7b2t2ytqw0h.png)


Navigate back to your storage account.
In the Security + networking blade, select Encryption.
![your storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8evthffd95h2hyaak6a9.png)

In the Encryption scopes tab, select Add.
![select Add](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vntknmu84rbkddurhhko.png)

Give your encryption scope a name.
![scope a name](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xuf7q8w2gz3r2x1lp0mv.png)


The Encryption type is Microsoft-managed key.
![Microsoft-managed key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m2idyyh6ipmspesqdg6b.png)

Set Infrastructure encryption to Enable.
Create the encryption scope.
![encryption scope](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8m8m7dnvdt0z542elpy4.png)

Return to your storage account and create a new container.
Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.
![New container page](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dwfuwzj7vcz3l7pm83jt.png)