Hi! I'm new to Azure and struggling to find solution to properly setup impersonation for the following use case. Problem I'm trying to solve is pushing data to a Storage that belong to a different accounts where I have no access. It can be hundreds accounts/storages I need to work with. The problem has the following constraints: I can't ask for target account credentials and I can't share credentials for my account with other account managers. However, I can provide steps for account managers so they can allow impersonation. I don't need to run a VM inside Azure. (I can potentially relax on this one if there is no other way) In order to illustrate it better, this is how above problem can be solved with other cloud providers: AWS: I create a role on my side. let's call it MyRole. Account manager creates a role that can access a bucket on their side. let's call it TargetRole Account manager creates trusted relationship between MyRole and TargetRole, so that I can use MyRole to call AssumeRole API and get temp credentials for TargetRole and access the bucket. GCP: I create service account on my side. let's call it MyServiceAccount. Account manager creates a service account that can access a bucket on their side. let's call it TargetServiceAccount Account manager grants MyServiceAccount access to impersonate TargetServiceAccount. Now I can use MyServiceAccount to call impersonation API and get temp credentials for TargetServiceAccount and access the bucket. What would be the right way to implement above scenario in Azure?

Use the valet key pattern More at https://learn.microsoft.com/en-us/azure/architecture/patterns/valet-key and https://learn.microsoft.com/en-us/azure/architecture/guide/multitenant/service/storage hth Marcin

How to properly setup impersonation in Azure?

Andrei Harbunou 0

Hi! I'm new to Azure and struggling to find solution to properly setup impersonation for the following use case.

Problem I'm trying to solve is pushing data to a Storage that belong to a different accounts where I have no access. It can be hundreds accounts/storages I need to work with.

The problem has the following constraints:

I can't ask for target account credentials and I can't share credentials for my account with other account managers. However, I can provide steps for account managers so they can allow impersonation.
I don't need to run a VM inside Azure. (I can potentially relax on this one if there is no other way)

In order to illustrate it better, this is how above problem can be solved with other cloud providers:

AWS:

I create a role on my side. let's call it MyRole.
Account manager creates a role that can access a bucket on their side. let's call it TargetRole
Account manager creates trusted relationship between MyRole and TargetRole, so that I can use MyRole to call AssumeRole API and get temp credentials for TargetRole and access the bucket.

GCP:

I create service account on my side. let's call it MyServiceAccount.
Account manager creates a service account that can access a bucket on their side. let's call it TargetServiceAccount
Account manager grants MyServiceAccount access to impersonate TargetServiceAccount. Now I can use MyServiceAccount to call impersonation API and get temp credentials for TargetServiceAccount and access the bucket.

What would be the right way to implement above scenario in Azure?

1 answer

Marcin Policht 24,120 Reputation points MVP

2024-03-19T22:38:43.5733333+00:00

Use the valet key pattern

More at https://learn.microsoft.com/en-us/azure/architecture/patterns/valet-key and

https://learn.microsoft.com/en-us/azure/architecture/guide/multitenant/service/storage

hth

Marcin
Please sign in to rate this answer.
Andrei Harbunou 0 Reputation points

2024-03-20T05:31:14.85+00:00

@Marcin Policht Thanks for quick response!

Please correct me if I'm wrong.

Based on the docs you provided valet key pattern looks like that for my use case:

Each account manager should setup an Azure Function that generates SAS token for their storage

I need to call the function to get the token and perform upload

if my understanding is right this would be too complex to setup on client side. I'm looking for a solution with minimal setup on target account but I'm ok with more complexity on my (source) side.

Is there a way to have a setup similar to AWS AssumeRole/GCP impersonation? Like using Managed Identity or similar kind of entity on both side and granting required access?

Marcin Policht 24,120 Reputation points MVP

2024-03-20T11:05:49.7+00:00

This is not set up on the client side. This is set up within a broker service - which serves as an intermediary between the client and the backend service

hth

Marcin

Andrei Harbunou 0 Reputation points

2024-03-20T21:01:13.07+00:00

@Marcin Policht

I'm a little bit confused now. I see how valet key pattern can be useful when there are a lot of client apps that need to upload data to a storage.

But I'm struggling to apply this concept on my use case as I need to upload data from one place to multiple target storages.

Let's assume:

I have an application (Uploader) deployed outside of Azure, for example on my laptop/on premise server. Uploader is supposed to upload data to multiple target storages in Azure.

There are 10 existed target accounts TargetAccount1, TargetAccount2 and etc that belong to 10 different organizations. Each TargetAccount has its own storage.

I also have my own Azure MyAccount with full access to it.

Could you please help me with the following questions:

What setup should be done on my MyAccount so Uploader can do the job? for example, should I create Azure Function to get tokens in my account? How to connect it to target storages?

What setup should be done on each TargetAccount to allow me to push data to a target storage?

Marcin Policht 24,120 Reputation points MVP

2024-03-20T22:19:20.4833333+00:00

What setup should be done on my MyAccount so Uploader can do the job? for example, should I create Azure Function to get tokens in my account? How to connect it to target storages? Azure Function should work.

What setup should be done on each TargetAccount to allow me to push data to a target storage? Azure Function needs to be able to access the target storage accounts. The simplest way to do this would be to provide the function with storage keys to target storage accounts (you might want to store the keys as secrets in Azure Key Vault and grant the function app the Get permissions to the secrets)

hth

Marcin

Andrei Harbunou 0 Reputation points

2024-03-21T22:44:48.2533333+00:00

@Marcin Policht Thanks for your suggestions.

I still have a lot of questions as I'm new to Azure.

Is it possible to setup a zoom call with you and go over my questions?

Marcin Policht 24,120 Reputation points MVP

2024-03-21T23:36:03.59+00:00

Hi Andrei,

if you have any additional questions, then mark this question as answered and post another one on the forum

hth

Marcin

Andrei Harbunou 0 Reputation points

2024-03-22T00:38:44.6433333+00:00

@Marcin Policht

All my questions related to the same problem. I just need more details about suggested solution as I still don't see a full picture.

Could you provide more details on how target account grants permission to access storage/keys in vault by a Function created in my account? It would be great of you can provide step by step guide.

Andrei Harbunou 0 Reputation points

2024-03-22T01:08:41.3166667+00:00

@Marcin Policht

All my questions related to the same problem. I just need more details about suggested solution as I still don't see a full picture.

Could you provide more details on how target account grants permission to access storage/keys in vault by a Function created in my account? It would be great of you can provide step by step guide.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to properly setup impersonation in Azure?

1 answer

Your answer