AzureFunBytes Episode 56 - Secretless Applications with @ChristosMatskas
Tags: security, infosec, azure, serverless
Published: 2021-09-09 19:10:57

AzureFunBytes is a weekly opportunity to learn more about the fundamentals and foundations that make up Azure. It's a chance for me to understand more about what people across the Azure organization do and how they do it. Every week we get together at 11 AM Pacific on [Microsoft LearnTV](https://cda.ms/226) and learn more about Azure.


![AzureFunBytes animation](https://res.cloudinary.com/practicaldev/image/fetch/s--Z7BxBMz1--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_66%2Cw_880/https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j2xzw2g664tj31jij13t.gif)

Secretless application development strives to solve some important problems, like preventing your credentials from being leaked. If you are seeing connection strings, usernames or passwords in log files, you're adding to your risk profile. So rather than transmit clear text credentials to log into a database for your application, you can use [Azure Managed Identity](https://cda.ms/2z6) which is a service account managed by the [Azure Active Directory](https://cda.ms/2z7).

This week on the show I've once again reached out to Microsoft Senior Program Manager [Christos Matskas](https://twitter.com/christosmatskas) for some help learning more about implementing a Secretless strategy in developing applications. After reading this incredible blog titled "[Secretless Azure Functions dev with the new Azure Identity Libraries](https://cda.ms/2z2)" I knew he was the right person for the job.

*Christos Matskas is a software developer, dad, blogger, husband, speaker, and all-around geek. He currently works as a Program Manager for Microsoft Identity helping developers and teams leverage the power of the identity and cloud. Before joining Microsoft, he was a successful entrepreneur collaborating with companies such as MarkIT, Lockheed Martin and Barclays. He's been building software for over 16 years and he's a passionate Open Source advocate. He contributes regularly to numerous OSS projects and works closely with the developer community to make the space bigger and better.*

{% youtube Bo1NtzjRV2k %}

[00:00:00 - Open](https://www.youtube.com/watch?v=Bo1NtzjRV2k)
[00:03:32 - Intro to show](https://youtu.be/Bo1NtzjRV2k?t=212)
[00:04:40 - Welcome Back Christos](https://youtu.be/Bo1NtzjRV2k?t=280)
[00:06:54 - Zero Trust principles](https://youtu.be/Bo1NtzjRV2k?t=412)
[00:15:37 -  Defining "Secretless"](https://youtu.be/Bo1NtzjRV2k?t=937)
[00:28:51 - Secretless with .NET](https://youtu.be/Bo1NtzjRV2k?t=1731) 
[00:42:18 - Can we use this approach with any language?](https://youtu.be/Bo1NtzjRV2k?t=2538)
[00:46:04 - Secretless with NodeJS](https://youtu.be/Bo1NtzjRV2k?t=2764)
[00:54:28 - What are you most excited about in the identity space?](https://youtu.be/Bo1NtzjRV2k?t=3268)

Here's our agenda:
- What do we mean by Secretless?
- Why it's important to eliminate secrets from our application and deployment code
- How can we achieve 'secretless state' with Azure?
- Demos

So check out this great opportunity to learn how to improve your application's security posture. 

------

Learn about Azure fundamentals with me!

Live stream is normally found on Twitch, YouTube, and [LearnTV](https://cda.ms/226) at 11 AM PT / 2 PM ET Thursday. You can also find the recordings here as well:

[AzureFunBytes on Twitch](https://twitch.tv/azurefunbytes)
[AzureFunBytes on YouTube](https://aka.ms/jaygordononyoutube)
[Azure DevOps YouTube Channel](https://www.youtube.com/channel/UC-ikyViYMM69joIAv7dlMsA)
[Follow AzureFunBytes on Twitter](https://twitter.com/azurefunbytes)

Useful Docs:

[Get $200 in free Azure Credit](https://cda.ms/219)
[Microsoft Learn: Introduction to Azure fundamentals](https://cda.ms/243)
[Manage security operations in Azure](https://cda.ms/2zR)
[DevBlogs: Secretless Azure Functions dev with the new Azure Identity Libraries](https://cda.ms/2z2)
[What are managed identities for Azure resources?](https://cda.ms/2z4)
[What is Azure Active Directory?](https://cda.ms/2z7)
[Azure AD-managed identities for Azure resources documentation](https://cda.ms/2z6)
[Embrace proactive security with Zero Trust](https://cda.ms/2zQ)
[Secretless Apps with the Microsoft Identity Platform](https://www.youtube.com/watch?v=TFBj8OHkewE)
[Introduction to Azure Functions](https://cda.ms/2z3)
[The 425 Show Blog](https://aka.ms/425Show/blog)
[The 425 Show Twitch](https://aka.ms/425Show)
[The 425 Show Website](https://aka.ms/425Show/web)
[Christos on TikTok](https://www.tiktok.com/@christosmatskas?)