https://www.techtarget.com/searchcloudcomputing/tutorial/Create-a-private-endpoint-to-secure-Azure-Functions-apps
Azure Functions enables developers to execute small pieces of code, or functions, in response to various events without the need to manage the underlying infrastructure. Multiple sources, such as HTTP requests, database operations and timer events, can trigger these functions.
With Azure Functions, developers can focus solely on their code, while Azure handles the scaling, maintenance and execution. This serverless architecture is ideal for building microservices, event-driven applications and automated tasks. It offers a cost-effective solution that charges only for the actual computing time used.
While there are numerous benefits, enterprises need to be proactive with security. Security is essential for Azure Functions for several reasons:
In this tip, learn the basics of a private endpoint, best practices, common mistakes to avoid and how to create a private endpoint.
Securing Azure Functions is not just about protecting a single function, but also safeguarding the entire ecosystem it interacts with, ensuring data integrity and maintaining trust.
A feature that helps protect Azure Functions is a private endpoint. This is a network interface that connects to a specific Azure service, such as Azure Functions, over a private link. It means the traffic between a virtual network and the Azure service is isolated from the public internet.
There are several benefits to using a private endpoint for Azure Functions:
The key to using private endpoints is to ensure that the underlying network configuration exists as required. A few approaches and practices can help keep a private endpoint secure, controlled and easy to manage. A few of these are the following:
A few additional options are the following:
To create a private endpoint for Azure Functions, you need the following:
Create an Azure function with one of the pre-built templates or use custom code. To do this, open Visual Studio, select New Project, choose Azure Function and then select the required template.
For this example, use the default Http trigger template, including all the sample code the template creates.
Complete the properties, and create the project. The following example code gets created by default when using the Microsoft Http trigger template -- the function name differs:
public static class funcAWZI0LK5
{
[FunctionName("funcAWZI0LK5")]
public static async Task<IActionResult> Run( [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = null)] HttpRequest req,
ILogger log)
{
log.LogInformation("C# HTTP trigger function processed a request.");
string name = req.Query["name"];
string requestBody = await new StreamReader(req.Body).ReadToEndAsync();
dynamic data = JsonConvert.DeserializeObject(requestBody);
name = name ?? data?.name;
string responseMessage = string.IsNullOrEmpty(name) ? "This HTTP triggered function executed successfully. Pass a name in the query string or in the request body for a personalized response.": $"Hello, {name}. This HTTP triggered function executed successfully.";
return new OkObjectResult(responseMessage);
}
}
To test the function, navigate to the overview page to get the URL.
Browsing to the URL displays an Azure page saying the function works. To use the code for the function, append the URL with /API/function-name -- in the sample code, that is /API/HttpAWZI0LK5. Or, if you want to pass data to it, you can use something like /API/HttpAWZI0LK5?name=Liam Cleary.
The default configuration allows anyone to call the function because it makes the authorization method anonymous. It is best to change this to a more secure option unless you need anonymous access to the function. Modify the code to the desired setting, add any specific configuration to the function and republish to Azure.
To utilize the private endpoint for the Azure function, navigate into the function in Azure Portal, and choose Networking within the settings section.
There are various options available for networking within an Azure function. All these options are disabled, so you need to select the required option:
To utilize the private endpoint option, click on the link which takes you to the configuration options.
Click the Add option to add the private endpoint, and then choose either Express or Advanced. The express options require a few values and then create the private endpoint.
Once the private endpoint is created within the configuration, both the private endpoint and access restrictions options get enabled. When browsing to the original endpoint URL, you do not get a forbidden message.
It now blocks regular external access in favor of the new private endpoint link. Within the access restriction configuration, the Allow Public Access checkbox is now unchecked, which blocks access to the public endpoint for both the main and advanced tool sites. Add a local DNS entry that knows how to get to the assigned IP address for the private endpoint.
To further secure the function with the private endpoint, add an application gateway that controls the external routing back to the private endpoint. Or ensure you have a private link to the Azure tenant direct from the network that calls the function.
There are a few common mistakes to avoid when creating private endpoints for Azure Functions:
06 Nov 2023