Securing App Data: Role-Based Access Control and Immutable Storage for Testing Environments
Tags: azure, programming, cloudcomputing, cloud
Published: 2023-12-05 17:20:47

## How to create a storage account and Managed identity
- In the market place search for storage account and select create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vp1c54qijr0m1ndbjkup.png)
- In the project details, select the resource group you just created
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m2eq3f1fnh08vr5gwicn.png)
- Under the instance details, supply the name for your storage account. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/11jorex44mu1qwk97mkp.png)
- Click review
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jno3uskc3wzgzj0uaani.png)
- Once validation is passed, click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/27ibc3nsb7m7ikhvhm95.png)
- Wait for it to deploy
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7elfe65abtysjx80f1w3.png)

## How to give the web application a managed identity to utilize.
- In the market place, search and create managed identity
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bwmc2sfjrbgiseo4qmov.png)
- Give name to the managed identity and click review + create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/710pl9s8gqthemz1uy2v.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j4v1x8b949nhix13e38h.png)
- Click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f4f8mo9j2ytnkkm9m62l.png)
- Wait for it to deploy
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jjpnkxkldutskgjr0llv.png)

## How to provide the managed identity the appropriate permissions.
- Go back to the storage account created earlier and select Access Control(IAM)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/spt2291jf4b17g5auifz.png)
- Click Add role assignment
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e8hs0suozwx24qbw8ia6.png)
- Search for Storage Blob Data Reader under Job functions roles and click on it
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k12uw41l2vp3vnlnihs3.png)
- Click members and select managed identity
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ae0xre0rgg8v0kpz94tk.png)
- Click +Select members and click on managed identity to select user-assigned managed identity
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tugutkb0zpoyip1mq8y7.png)
- Select the managed identity created earlier
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r2bjjgbk1z5ze56qt8ri.png)
- Click select
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gy0g0in93gkk0pvsbej8.png)
- Then click Review + assign
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mc1skx79ku26z91jzvvj.png)
- Click Review + assign the second time to add role assignment
A managed identity with the Storage Data Blob Reader rights can now access your storage account.

## How to Use a key vault and key to provide secure access to the storage account
- Go to the resource group where your storage account is, select Access Control (IAM).
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/92s4uoyltiwh0597apkt.png)
- Click Add role assignment
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4ks7mb7zny0rpa3vx068.png)
- Search for Key vault administrator under Job functions role and select it
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ynkj30pcvtvavz1q87x6.png)
- Tick User, group, or service principal under Members page
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xhwr2j5zqj8kh7panii1.png)
- Click + Select members and choose your user account
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l8o4euqjned80yenwhcr.png)
- Click select
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qowqho4f5old5vy8fo0w.png)
- Click Review + assign
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6er359ylmylxj3oruk3x.png)
- Click Review + assign the second time to add the role assignment

## How to create a key vault to keep the access keys
- Search for key vaults in market place and click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3uqxorhkwjj5q0ljfidy.png)
- Select your resource group, give name to your key vault, leave others as default and select Review + create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/efaxjklc9zr5vdtxtr0e.png)
- Click create after validating
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kgee5svcrae2hl6v30zt.png)
- Wait for it to deploy
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/05kn3jeel1hks593vzf5.png)
- Click Go to resource after deployment is complete
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l37ppsgj8pat6lndvtr5.png)
- Ensure that both soft delete and purge protection are enabled in the overview page. By default, soft delete is enabled and purge protection is disabled.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/64vyfkh7yj1jj0t7zhd7.png) 
-To enable purge protection click on disabled in front of it
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ltt6g66t3nj2popbjhfm.png)
- Click save
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xfld8kw4o3bvh2byguth.png)
- Click Keys in the Objects section and select +Generate/import
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/10cbqunr41c2kxb6llck.png)
- Give name to the key, leave other settings as default and select create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rdz3ngmfcfmr9frk442m.png)

## How to set up the storage account in the key vault to use the customer-managed key.
First assign to the Managed identity, Key Vault Crypto Service Encryption User role.
- Go to the resource group  and click Access Control (IAM)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zy4n5f0oqadt1uyogixj.png)
- Click Add role assignment 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b889jpr8fjh0rqdzbmjn.png)
- Search and select Key Vault Crypto Service Encryption User under Job function roles
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qs2ilz26cnltxtgwl927.png)
- Under Member page tick managed identity and select +select member
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d0wdfnlmfm7z6shjd8mr.png)
- Select User-assigned managed identity in the Managed identity drop-down
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gzbisjcmpst8t2kh6mv4.png)
- Click your Managed identity and click select
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nnvn1pcnwyiktsj8ugsf.png)
- Click Review + assign
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9lz2kousmtsjvrrnha7u.png)
- Click Review + assign the second time to add role

## How to set your key vault's customer managed key to be used for the storage account.
- Go back to your storage account
- Click Encryption under Security + networking and tick Customer-managed keys
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zak8j21l2kucaj31aur9.png)
- Click Select a key vault and key
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zhb3pxfem9bwa9bsj9cq.png)
- Input your key vault and key
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/czt69upesmcj32s9h7vc.png)
- Click Select
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3fo92k82ztdimoxp8wik.png)
- Change Identity type to User-assigned and click Select an identity
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8pyalr1hvceufabhl1hd.png)
- Click your managed identity and click Add
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l85xvwxz6x830phe5zia.png)
- Click save
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/brmv7jy66e9eekwtmfa9.png)

## How to set up encryption scope and a time-based retention policy.
First create a blob immutable storage
- Go to your storage account
- Select containers in the Data storage section
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dw8be2tmskkphrtkjg7q.png)
- Create a container by clicking +container
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u44ucaj11igk4cxdex2o.png)
- Give the container name and click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j7e76zopsv1ojii1ffum.png)
- Upload a file into the container by clicking on the created container
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ytymns9wyhtsmnl4ke89.png)
Click upload
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dnv35bo5nb0odstzfsom.png)
- Browse for a file and click upload 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qb9y6u76icoz6qgq9dv1.png)
- Click on Access policy in the settings section, click + Add policy in the immutable blob storage section
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uxa5brs755i4t71asuu4.png)
- Change policy type to time-based retention, choose a retention period and click save
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a4u2i45s39zpiittrmr0.png)
To check, we need to delete our uploaded file and it will display failed to delete blobs due to policy

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hzotf3lea9w80ud5vakz.png)

## How to configure Infrastructure Encryption
- Go back to the storage account and select Encryption in the Security + networking section, click Add in the Encryption scopes tab
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jfsx6ztzr5z2h7kfb13q.png)
- Choose a name for encryption scope, change Encryption type to Microsoft-managed key, enable Infrastructure encryption and click create
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/diw0zcatw966cf7u3qw3.png)
- Now go back to your storage account to create a new container, In the New container pane, in advanced section, you will be able to select the Encryption scope created earlier and apply it to the container and the blob in it
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xjb2gzk99ril6b61bckv.png)