Securely deploy to App Service

Question

I have a dotnet website deployed as an App Service. I would like to know what is the best way to publish changes to the source code. Is it FTPS/Web Deploy etc!? I want to minimize privilege as least as possible. Please advise.

Answer 1

Hello! To securely deploy your dotnet website to Azure App Service, you can use Azure DevOps to automate the deployment process. This will allow you to minimize privileges and ensure that the developer vendor's credentials are not exposed. Here are the steps you can follow:

1. Create a new Azure DevOps project and repository.
2. Add your dotnet website code to the repository.
3. Create a new build pipeline that builds your dotnet website code and creates an artifact.
4. Create a new release pipeline that deploys the artifact to your App Service.
5. Configure the release pipeline to use deployment slots for testing and staging before deploying to production.

By using Azure DevOps, you can ensure that the deployment process is automated and secure. You can also set up role-based access control (RBAC) to ensure that only authorized users have access to the deployment pipelines.

Regarding your concern about the developer vendor being compromised, you can take the following steps to ensure that their credentials are not exposed:

1. Use RBAC to limit the developer vendor's access to only the resources they need to deploy the website.
2. Use Azure Key Vault to store any secrets or connection strings needed for the deployment process.
3. Use Azure AD to enforce multi-factor authentication (MFA) for all users, including the developer vendor.

By following these best practices, you can ensure that your dotnet website is deployed securely and that your environment is protected from any potential security threats. Let me know if you have any further questions!

To limit the developer vendor's access to only the resources they need to deploy the website, you can assign them the Contributor role at the App Service level. This will allow them to deploy the website to the App Service, but they will not have access to any other resources in your Azure subscription.

To assign the Contributor role to the developer vendor at the App Service level, follow these steps:

1. Go to the Azure portal and navigate to your App Service.
2. Click on "Access control (IAM)" in the left-hand menu.
3. Click on the "+ Add" button and select "Add role assignment".
4. In the "Add role assignment" blade, select "Contributor" as the role.
5. In the "Assign access to" section, select "User, group, or service principal".
6. In the "Select" field, search for the developer vendor's account and select it.
7. Click on the "Save" button to assign the Contributor role to the developer vendor.

By assigning the Contributor role at the App Service level, you are limiting the developer vendor's access to only the resources they need to deploy the website. This will help to minimize the risk of any potential security threats. Do note that with the Contributor role at the App Service level, the developer vendor will be able to make changes to the configuration of the App Service. This includes changing the settings, scaling the App Service, and deploying new versions of the website.

If you want to limit the developer vendor's access to only certain aspects of the App Service, you can create a custom role with the specific permissions that you want to grant. For example, you can create a custom role that allows the developer vendor to deploy new versions of the website but does not allow them to change the settings or scale the App Service.

To create a custom role, follow these steps:

1. Go to the Azure portal and navigate to your subscription.
2. Click on "Access control (IAM)" in the left-hand menu.
3. Click on the "+ Add" button and select "Add custom role".
4. In the "Add custom role" blade, give the role a name and description.
5. In the "Actions" section, select the specific actions that you want to allow for the role.
6. In the "Data actions" section, select the specific data actions that you want to allow for the role.
7. In the "Not actions" and "Not data actions" sections, select the specific actions that you want to deny for the role.
8. Click on the "Review + create" button to create the custom role.

By creating a custom role, you can grant the developer vendor the specific permissions they need to deploy the website, while limiting their access to other aspects of the App Service. This will help to minimize the risk of any potential security threats.

Further, another item to consider using is Azure Key Vault. This will allow you to safely store your database connection strings in an encrypted method, along with storing certificates, or any other type of secret that you want. This can then allow you to create a key vault and gain full access and control over it. The vault owner can also set up auditing to log who accesses secrets and keys. Administrators can control the key lifecycle. They can roll to a new version of the key, back it up, and do related tasks. This limits the exposure to your secrets as your developer will only know the key and not the actual connection. This can allow you to rotate keys as needed or revoke/issue new keys quickly if concerns arise.

Disclaimers: Please note that these are recommendations for safety and security. As the owner, you are ultimately responsible for ensuring a safe environment. If you have further questions, please reach out to us on here so we can assist you further. Lastly, part of this message was generated using OpenAI.