Brian T. Jackett Sr. Premier Field Engineer Microsoft

Transcription

1 Don t DoS the Proxy

2

3 Brian T. Jackett Sr. Premier Field Engineer Microsoft

4

5 Sr. Premier Field Engineer at Microsoft Office 365 Dev / Admin, Azure Dev Stir Trek Conference Organizer Blog: Brian.Jackett@Microsoft.com

6

7 Azure Functions Design Considerations Authentication Security Concerns Durable Functions Tips and Tricks

8 -Jeff Atwood

9

10 SharePoint on-prem server farm Proposed hosting for autonomic tasks Microsoft Azure <N> Web Front End servers Custom applications run on these servers Serverless no servers to care and feed, patch, etc. <N> Application servers X Proxy Office 365 No servers to host custom applications, server side code not allowed Cloud to cloud communication Azure Serverless (Functions) Storage queue Azure Key Vault <N> Database servers Current State Log Analytics Future State

11 Serverless Compute Run code without managing infrastructure or platform Supported languages Experimental languages

12 Triggers HTTP Queue Blob Webhook Timer Bindings HTTP Queue Blob Webhook Twilio

13 Two styles of functions Pre-compiled (ex. Visual Studio) Uncompiled (ex. VS Code or Azure Portal) Components Trigger event starts the function Input binding additional input at start Output binding where to send output

14 Consumption Pay per use Auto resource allocation Max timeout 10 minutes (default 5) Dedicated Pay monthly = App Service Plan No warm up (Always On setting) Flexible resource allocation Run > 10 minutes

15 Portal Visual Studio Authentication + Security Super Special Demo

16

17 Azure Functions Design Considerations Authentication Security Concerns Durable Functions Tips and Tricks

18 Local development = same functions runtime Visual Studio 2017 version or- Azure Functions Core Tools Storage Azure Storage Explorer

19 Event driven programming

20 Don t re-invent the wheel

21 A different style of thinking Design code to run as fast as possible with smallest footprint

22 Efficiency

23 Separate configuration from code Stored encrypted Readable in plaintext in Azure Portal though Language Syntax C# %NameOfVariable% PowerShell $Env:NameOfVariable

24 Portal Visual Studio Authentication + Security Super Special Demo

25 Azure Functions Design Considerations Authentication Security Concerns Durable Functions Tips and Tricks

26 What are you connecting to? SharePoint Online MS Graph Azure Storage How are you storing credentials? App Settings Azure Key Vault

27 Connect to data source (ex. SharePoint Online)?

28 App Service Managed Service Identity (MSI)

29 App Service App Settings Azure Key Vault

30 Azure Functions Design Considerations Authentication Security Concerns Durable Functions Tips and Tricks

31 Azure Services with Public Endpoints App service (function) Storage Secure these properly!

32 App Service (function) Configure authentication Disable anonymous access

33 App Service (function) Disable the default homepage App Setting AzureWebJobsDisableHomepage = True

34 Access keys = keys to the kingdom Read / write to entire storage account Rotate regularly Store securely Caution with who has access to keys

35 Shared Access Signature (SAS) token Use SAS tokens when possible Scoped to Account or Container Time bound Allowed Permissions Allowed IPs

36 Portal Visual Studio Authentication + Security Super Special Demo

37 Azure Functions Design Considerations Authentication Security Concerns Durable Functions Tips and Tricks

38 Stateful functions

39

40

41 Function Chaining Fan-out / fan-in Human interaction

42 Portal Visual Studio Authentication + Security Super Special Demo

43 Portal Visual Studio Authentication + Security Super Special Demo

44 Automatically apply retention labels in SharePoint Online

45 Azure Functions Design Considerations Authentication Security Concerns Durable Functions Tips and Tricks

46 Azure Storage Explorer to see data in storage If using app service plan, enable Always On setting Functions running locally = no money spent Freebies per month

47

48