The Secret Life of Azure: The Identity That Didn’t Need a Password
.jpeg)
Eliminating the "Secret Zero" problem through Managed Identities.
Governance & Guardrails
The library was quiet, but Timothy was staring at the chalkboard with a look of intense concentration. He had successfully moved his database password into the Key Vault, but a new question was clearly bothering him.
"Margaret," he said, turning around, "I understand that the password is safe in the Vault now. But to get into the Vault, doesn't my application still need a client secret or a certificate? It feels like I’ve just moved the problem. I’m still holding a key; I’ve just changed which door it opens."
Margaret smiled, set down her book, and picked up the chalk. "You’ve discovered the 'Secret Zero' problem, Timothy. If you need a secret to get a secret, the chain never ends. But in Azure, we can break that chain. We give the application an identity that exists purely as a part of the Azure infrastructure."
She drew a silhouette of a person on the board and labeled it Managed Identity.
The Badge Without a Key
"A Managed Identity," Margaret explained, "is a service principal that is automatically managed by Microsoft Entra ID. There is no password for you to remember, no secret to rotate, and no certificate to renew. The 'secret' is the fact that the resource is running on Azure hardware."
Timothy leaned in. "So, if my Web App wants to talk to the Key Vault, it doesn't present a password?"
"No," Margaret said. "It presents its Identity Token. When the app asks for a token, Azure’s underlying infrastructure verifies that the request is coming from the actual, running instance of your Web App. It issues a short-lived token that the Key Vault accepts. No human ever sees a password, because for Managed Identity, the password doesn't exist."
System-Assigned vs. User-Assigned
Margaret divided the silhouette on the board into two types.
"We have two flavors of this identity," she said.
- System-Assigned: This is tied directly to the resource. If you delete the Web App, the identity dies with it. It’s simple and clean for one-to-one relationships.
- User-Assigned: This is a standalone Azure resource. You can create one 'Identity' and hand it to ten different Function Apps. It’s perfect for when multiple resources need the same set of permissions.
The Principle of Least Privilege
Timothy looked at the board. "So, once I give my app this identity, it can just... do things?"
"Only what you allow," Margaret cautioned. "An identity without permissions is just a name. You still have to go to the Key Vault—or the Storage Account, or the Database—and grant that specific identity the 'Secret User' or 'Contributor' role. We are still using RBAC; we’re just using it with an identity that doesn't have a login screen."
Putting It into Practice
Timothy started erasing his old notes about "Service Principals" and "Client Secrets."
"I see it now," he said. "The application doesn't 'log in' like a human does. It just exists within the environment, and the environment recognizes it. We’ve finally reached the point where the code doesn't have to carry any baggage at all."
Margaret nodded. "That is the goal, Timothy. When you remove the credentials, you remove the most common way for a library to be compromised. You aren't just securing the app; you’re simplifying the entire architecture."
Key Concepts
- Managed Identity: An identity in Microsoft Entra ID that is automatically managed by Azure, eliminating the need for developers to manage credentials.
- System-Assigned Identity: An identity enabled directly on an Azure service instance; its lifecycle is tied to that resource.
- User-Assigned Identity: A standalone Azure resource that can be assigned to one or more Azure service instances.
- Token Service: The internal Azure endpoint (IMDS) that provides the identity token to the resource at runtime.
- Secret-less Connection: An architecture where no connection strings or passwords are stored in configuration, relying entirely on Managed Identity and RBAC.
Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.
Comments
Post a Comment