Restrict Azure Functions access to Front Door

Question

Hi everyone,

I would like to protect my Azure Functions against DDOS attacks. For this purpose I set up a Front Door and successfully connected it to my Azure Functions. Now I would like to restrict access to the Functions to just the front door. I tried to accomplish this according to the following section:
https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq#how-do-i-lock-down-the-access-to-my-backend-to-only-azure-front-door

However, the article suggests to download a JSON with dozens of IP addresses, and also suggests to filter by the IP header X-Azure-FDID, which I can't seem to configure in the "Networking" --> "Access Restrictions" of my App Service. Thus my questions:

1. Do I really need to manually add dozens of IP addresses or can this be configured more easily?
2. How do I restrict by header in an App Service?

Thank you,
Pascal

Answer 1

1. Yes for the consumption/premium tiers. If your function app is deployed into a VNET, then you could leverage the AzureFrontDoor.Backend service tag instead.
2. This is something you will have to check in your code (in most frameworks, this would be a simple middleware)

Another way to protect your function apps that you could consider would be to use Azure API Management. Depending on the tier of APIM you choose, your setup will vary

• For Premium Tier, you could deploy it into multiple regions and set each regional gateways IP in your function apps access restriction settings. Configuration for your APIs is synchronized by default.
• For Basic/Standard Tier, you would have to manually deploy multiple APIM instances to each region and set each instances IP in your function apps access restriction settings. You could then set them up as backends in Front Door or Traffic Manager. Configuration for your APIs would have to be manually synchronized as well.
• For Consumption Tier, you would have to manually deploy multiple APIM instances to each region but the IP of each instance isn't static, so you will have to rely on other means to protect your function apps like OAuth or the function key itself. You could then set them up as backends in Front Door or Traffic Manager. Configuration for your APIs would have to be manually synchronized as well.

Answer 2

Incase we do not have VNET then what