Disabling Managed Identities can reduce an organization’s ability to protect itself against configuration faults and credential leaks.
Authenticating via managed identities to an Azure resource solely relies on an API call with a non-secret token. The process is inner to Azure:
secrets used by Azure are not even accessible to end-users.
In typical scenarios without managed identities, the use of credentials can lead to mistakenly leaving them in code bases. In addition,
configuration faults may also happen when storing these values or assigning them permissions.
By transparently taking care of the Azure Active Directory authentication, Managed Identities allow getting rid of day-to-day credentials
management.
Ask Yourself Whether
The resource:
- Needs to authenticate to Azure resources that support Azure Active Directory (AAD).
- Uses a different Access Control system that doesn’t guarantee the same security controls as AAD, or no Access Control system at all.
There is a risk if you answered yes to all of those questions.
Recommended Secure Coding Practices
Enable the Managed Identities capabilities of this Azure resource. If supported, use a System-Assigned managed identity, as:
- It cannot be shared across resources.
- Its life cycle is deeply tied to the life cycle of its Azure resource.
- It provides a unique independent identity.
Alternatively, User-Assigned Managed Identities can also be used but don’t guarantee the properties listed above.
Sensitive Code Example
Using ARM templates:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.ApiManagement/service",
"apiVersion": "2022-09-01-preview",
"name": "apiManagementService"
}
]
}
Using Bicep:
resource sensitiveApiManagementService 'Microsoft.ApiManagement/service@2022-09-01-preview' = {
name: 'apiManagementService'
// Sensitive: no Managed Identity is defined
}
Compliant Solution
Using ARM templates:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.ApiManagement/service",
"apiVersion": "2022-09-01-preview",
"name": "apiManagementService",
"identity": {
"type": "SystemAssigned"
}
}
]
}
Using Bicep:
resource sensitiveApiManagementService 'Microsoft.ApiManagement/service@2022-09-01-preview' = {
name: 'apiManagementService'
identity: {
type: 'SystemAssigned'
}
}
See
