Hello, I have a customer who is looking for a way to mask the App Insight connection string. Is there a way to do that? Thanks.

Hi @Terru Ahmad , Welcome to the Microsoft Q&A Platform! Thank you for asking your question here. There are ways to mask the Application Insights connection string in your application. Here are some options: Use Azure Key Vault: You can store the Application Insights connection string in Azure Key Vault and retrieve it at runtime in your application. This way, the connection string is not exposed in your application code or configuration files. You can use Azure Managed Identity to authenticate your application to Azure Key Vault. Use Azure App Configuration: You can store the Application Insights connection string in Azure App Configuration and retrieve it at runtime in your application. This way, the connection string is not exposed in your application code or configuration files. You can use Azure Managed Identity to authenticate your application to Azure App Configuration. Use environment variables: You can store the Application Insights connection string as an environment variable on the machine where your application is running. Your application can retrieve the connection string from the environment variable at runtime. This way, the connection string is not exposed in your application code or configuration files. Use Azure Functions: You can create an Azure Function that retrieves the Application Insights connection string from a secure location such as Azure Key Vault or Azure App Configuration and returns it to your application. Your application can call the Azure Function to retrieve the connection string at runtime. This way, the connection string is not exposed in your application code or configuration files. These are some of the options to mask the Application Insights connection string in your application. You can choose the option that best suits your requirements and security needs. If you have any further queries, do let us know. If the Answer is helpful, please click "Accept Answer".

Mask Azure App Insight Connection String

Accepted answer

Pavan Minukuri 765 Reputation points Microsoft Vendor

2024-11-07T00:24:21.2566667+00:00

Hi @Terru Ahmad ,
Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

There are ways to mask the Application Insights connection string in your application. Here are some options:

Use Azure Key Vault: You can store the Application Insights connection string in Azure Key Vault and retrieve it at runtime in your application. This way, the connection string is not exposed in your application code or configuration files. You can use Azure Managed Identity to authenticate your application to Azure Key Vault.

Use Azure App Configuration: You can store the Application Insights connection string in Azure App Configuration and retrieve it at runtime in your application. This way, the connection string is not exposed in your application code or configuration files. You can use Azure Managed Identity to authenticate your application to Azure App Configuration.

Use environment variables: You can store the Application Insights connection string as an environment variable on the machine where your application is running. Your application can retrieve the connection string from the environment variable at runtime. This way, the connection string is not exposed in your application code or configuration files.

Use Azure Functions: You can create an Azure Function that retrieves the Application Insights connection string from a secure location such as Azure Key Vault or Azure App Configuration and returns it to your application. Your application can call the Azure Function to retrieve the connection string at runtime. This way, the connection string is not exposed in your application code or configuration files.

These are some of the options to mask the Application Insights connection string in your application. You can choose the option that best suits your requirements and security needs.

If you have any further queries, do let us know. If the Answer is helpful, please click "Accept Answer".
Please sign in to rate this answer.
Pavan Minukuri 765 Reputation points Microsoft Vendor

2024-11-07T17:52:57.4833333+00:00

Hi @Terru Ahmad ,
We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.
Thank you.!

Terru Ahmad 40 Reputation points Microsoft Employee

2024-11-07T18:23:54.5533333+00:00

Hello Pavan, Thanks for your response. These are great options that I can share with the customer. In addition, the customer is asking if there is a way to secure the connection string in the URL or API call as well (traffic in flight). I know traffic between the App (APIM) and App insight is encrypted. Not sure if the connection is encrypted though. Any thoughts?

e.g.

{

type": "Microsoft.ApiManagement/service/loggers",

"apiVersion": "2022-08-01",

"name": "ContosoLogger1",

"properties": {

"loggerType": "applicationInsights", "description": "Application Insights logger with system-assigned managed identity", "resourceId": "<ApplicationInsightsResourceID>", "credentials": { "connectionString": "InstrumentationKey=00000000-0000-0000-0000-000000000000;IngestionEndpoint=https://xxxx.applicationinsights.azure.com/;...", "identityClientId": "SystemAssigned" }

}

}

Pavan Minukuri 765 Reputation points Microsoft Vendor

2024-11-07T19:13:59.8633333+00:00

Hi @Terru Ahmad ,
Thanks for replying
To secure the connection string in API calls, particularly when dealing with traffic in flight, several best practices and technologies can be employed. Here are the key points to consider:

Use HTTPS for Encryption

Ensure that all API calls are made over HTTPS rather than HTTP. HTTPS encrypts the data exchanged between the client and server, protecting it from eavesdropping during transmission. This includes the entire URL, headers, and body of the request, which helps secure sensitive information such as connection strings or API keys[2][4].

Avoid Including Secrets in URLs

It is generally not advisable to include sensitive information like API keys or connection strings in the URL. URLs can be logged in various places (e.g., browser history, server logs), potentially exposing sensitive data. Instead, consider using headers to pass authentication tokens or other sensitive information[2][3].

Implement Token-Based Authentication:

Utilize token-based authentication methods such as JWT (JSON Web Tokens) or OAuth 2.0. By sending tokens in the headers of your requests rather than in the URL, you reduce the risk of exposing sensitive information[1][4]. For example: `

const api = axios.create({ baseURL: 'https://your-api-url.com/' }); async function callApi() { try { const response = await api.get('/protected-route', { headers: { Authorization: 'Bearer your-token' } }); console.log(response.data); } catch (error) { console.error(error); } } callApi();

Use Environment Variables for Sensitive Data

Store sensitive information such as connection strings or API keys in environment variables rather than hardcoding them into your application code. This practice helps keep secrets out of your source code and reduces the risk of accidental exposure.

Regularly Rotate Secrets

Implement a policy for regularly rotating your API keys and connection strings to minimize the impact of potential leaks.

If you have any further queries, do let us know.

Pavan Minukuri 765 Reputation points Microsoft Vendor

2024-11-08T17:47:01.5533333+00:00

Hi @Terru Ahmad ,
Just want to check is that issue resolved or else if you need any help, please let us know we will always help as you needed.! if you had chance please review once my response. Thank you.!

Pavan Minukuri 765 Reputation points Microsoft Vendor

2024-11-11T16:20:32.88+00:00

Hi @Terru Ahmad ,
Just want to check is that issue resolved or else if you need any help, please let us know we will always help as you needed.! if you had chance please review once my response. Thank you.!

Terru Ahmad 40 Reputation points Microsoft Employee

2024-11-11T21:47:39.3333333+00:00

Hello @Pavan Minukuri ,Thanks for answering my questions. I will review this information with the customer.

Thanks!

Pavan Minukuri 765 Reputation points Microsoft Vendor

2024-11-12T17:15:58.58+00:00

Hi @Terru Ahmad ,
Could you please Accept answer, so it was helpful to the other community member.
Thank you
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Mask Azure App Insight Connection String

0 additional answers

Your answer