Skip to content

Commit 01f6030

Browse files
spelluruspelluru
committed
retstructure
1 parent 180b1e5 commit 01f6030

File tree

2 files changed

+190
-170
lines changed

2 files changed

+190
-170
lines changed

‎articles/event-grid/security-authentication.md

Lines changed: 7 additions & 170 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
---
22
title: Azure Event Grid security and authentication
3-
description: Describes Azure Event Grid and its concepts.
3+
description: This article describes different ways of authenticating access to your Event Grid resources (WebHook, subscriptions, custom topics)
44
services: event-grid
55
author: banisadr
66
manager: timlt
77

88
ms.service: event-grid
99
ms.topic: conceptual
10-
ms.date: 05/22/2019
10+
ms.date: 03/06/2020
1111
ms.author: babanisa
1212
---
13-
# Event Grid security and authentication
13+
# Authenticating access to Event Grid resources
1414

1515
Azure Event Grid has three types of authentication:
1616

@@ -38,7 +38,7 @@ If you're using any other type of endpoint, such as an HTTP trigger based Azure
3838

3939
The provided URL is valid for 5 minutes. During that time, the provisioning state of the event subscription is `AwaitingManualAction`. If you don't complete the manual validation within 5 minutes, the provisioning state is set to `Failed`. You'll have to create the event subscription again before starting the manual validation.
4040

41-
This authentication mechanism also requires the webhook endpoint to return an HTTP status code of 200 so that it knows that the POST for the validation event was accepted before it can be put in the manual validation mode. In other words, if the endpoint returns 200 but doesn’t return back a validation response programmatically, the mode is transitioned to the manual validation mode. If there is a GET on the validation URL within 5 minutes, the validation handshake is considered to be successful.
41+
This authentication mechanism also requires the webhook endpoint to return an HTTP status code of 200 so that it knows that the POST for the validation event was accepted before it can be put in the manual validation mode. In other words, if the endpoint returns 200 but doesn't return back a validation response programmatically, the mode is transitioned to the manual validation mode. If there's a GET on the validation URL within 5 minutes, the validation handshake is considered to be successful.
4242

4343
> [!NOTE]
4444
> Using self-signed certificates for validation isn't supported. Use a signed certificate from a certificate authority (CA) instead.
@@ -80,7 +80,7 @@ To prove endpoint ownership, echo back the validation code in the validationResp
8080
}
8181
```
8282

83-
You must return an HTTP 200 OK response status code. HTTP 202 Accepted is not recognized as a valid Event Grid subscription validation response. The http request must complete within 30 seconds. If the operation doesn’t finish within 30 seconds then the operation will be canceled and it may be re-attempted after 5 seconds. If all the attempts fail then it will be treated as validation handshake error.
83+
You must return an HTTP 200 OK response status code. HTTP 202 Accepted is not recognized as a valid Event Grid subscription validation response. The http request must complete within 30 seconds. If the operation doesn't finish within 30 seconds, then the operation will be canceled and it may be reattempted after 5 seconds. If all the attempts fail, then it will be treated as validation handshake error.
8484

8585
Or, you can manually validate the subscription by sending a GET request to the validation URL. The event subscription stays in a pending state until validated. The validation Url uses port 553. If your firewall rules block port 553 then rules may need to be updated for successful manual handshake.
8686

@@ -99,7 +99,7 @@ During event subscription creation, if you're seeing an error message such as "T
9999

100100
#### Azure AD
101101

102-
You can secure your webhook endpoint by using Azure Active Directory to authenticate and authorize Event Grid to publish events to your endpoints. You will need to create an Azure Active Directory Application, create a role and service principle in your application authorizing Event Grid, and configure the event subscription to use the Azure AD Application. [Learn how to configure AAD with Event Grid](secure-webhook-delivery.md).
102+
You can secure your webhook endpoint by using Azure Active Directory to authenticate and authorize Event Grid to publish events to your endpoints. You'll need to create an Azure Active Directory Application, create a role and service principle in your application authorizing Event Grid, and configure the event subscription to use the Azure AD Application. [Learn how to configure AAD with Event Grid](secure-webhook-delivery.md).
103103

104104
#### Query parameters
105105
You can secure your webhook endpoint by adding query parameters to the webhook URL when creating an Event Subscription. Set one of these query parameters to be a secret such as an [access token](https://en.wikipedia.org/wiki/Access_token). The webhook can use the secret to recognize the event is coming from Event Grid with valid permissions. Event Grid will include these query parameters in every event delivery to the webhook.
@@ -185,172 +185,9 @@ static string BuildSharedAccessSignature(string resource, DateTime expirationUtc
185185
}
186186
```
187187

188-
## Management Access Control
189-
190-
Azure Event Grid allows you to control the level of access given to different users to do various management operations such as list event subscriptions, create new ones, and generate keys. Event Grid uses Azure's role-based access control (RBAC).
191-
192-
### Operation types
193-
194-
Event Grid supports the following actions:
195-
196-
* Microsoft.EventGrid/*/read
197-
* Microsoft.EventGrid/*/write
198-
* Microsoft.EventGrid/*/delete
199-
* Microsoft.EventGrid/eventSubscriptions/getFullUrl/action
200-
* Microsoft.EventGrid/topics/listKeys/action
201-
* Microsoft.EventGrid/topics/regenerateKey/action
202-
203-
The last three operations return potentially secret information, which gets filtered out of normal read operations. It's recommended that you restrict access to these operations.
204-
205-
### Built-in roles
206-
207-
Event Grid provides two built-in roles for managing event subscriptions. They are important when implementing [event domains](event-domains.md) because they give users the permissions they need to subscribe to topics in your event domain. These roles are focused on event subscriptions and don't grant access for actions such as creating topics.
208-
209-
You can [assign these roles to a user or group](../role-based-access-control/quickstart-assign-role-user-portal.md).
210-
211-
**EventGrid EventSubscription Contributor**: manage Event Grid subscription operations
212-
213-
```json
214-
[
215-
{
216-
"Description": "Lets you manage EventGrid event subscription operations.",
217-
"IsBuiltIn": true,
218-
"Id": "428e0ff05e574d9ca2212c70d0e0a443",
219-
"Name": "EventGrid EventSubscription Contributor",
220-
"IsServiceRole": false,
221-
"Permissions": [
222-
{
223-
"Actions": [
224-
"Microsoft.Authorization/*/read",
225-
"Microsoft.EventGrid/eventSubscriptions/*",
226-
"Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
227-
"Microsoft.EventGrid/locations/eventSubscriptions/read",
228-
"Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
229-
"Microsoft.Insights/alertRules/*",
230-
"Microsoft.Resources/deployments/*",
231-
"Microsoft.Resources/subscriptions/resourceGroups/read",
232-
"Microsoft.Support/*"
233-
],
234-
"NotActions": [],
235-
"DataActions": [],
236-
"NotDataActions": [],
237-
"Condition": null
238-
}
239-
],
240-
"Scopes": [
241-
"/"
242-
]
243-
}
244-
]
245-
```
246-
247-
**EventGrid EventSubscription Reader**: read Event Grid subscriptions
248-
249-
```json
250-
[
251-
{
252-
"Description": "Lets you read EventGrid event subscriptions.",
253-
"IsBuiltIn": true,
254-
"Id": "2414bbcf64974faf8c65045460748405",
255-
"Name": "EventGrid EventSubscription Reader",
256-
"IsServiceRole": false,
257-
"Permissions": [
258-
{
259-
"Actions": [
260-
"Microsoft.Authorization/*/read",
261-
"Microsoft.EventGrid/eventSubscriptions/read",
262-
"Microsoft.EventGrid/topicTypes/eventSubscriptions/read",
263-
"Microsoft.EventGrid/locations/eventSubscriptions/read",
264-
"Microsoft.EventGrid/locations/topicTypes/eventSubscriptions/read",
265-
"Microsoft.Resources/subscriptions/resourceGroups/read"
266-
],
267-
"NotActions": [],
268-
"DataActions": [],
269-
"NotDataActions": []
270-
}
271-
],
272-
"Scopes": [
273-
"/"
274-
]
275-
}
276-
]
277-
```
278-
279-
### Custom roles
280-
281-
If you need to specify permissions that are different than the built-in roles, you can create custom roles.
282-
283-
The following are sample Event Grid role definitions that allow users to take different actions. These custom roles are different from the built-in roles because they grant broader access than just event subscriptions.
284-
285-
**EventGridReadOnlyRole.json**: Only allow read-only operations.
286-
287-
```json
288-
{
289-
"Name": "Event grid read only role",
290-
"Id": "7C0B6B59-A278-4B62-BA19-411B70753856",
291-
"IsCustom": true,
292-
"Description": "Event grid read only role",
293-
"Actions": [
294-
"Microsoft.EventGrid/*/read"
295-
],
296-
"NotActions": [
297-
],
298-
"AssignableScopes": [
299-
"/subscriptions/<Subscription Id>"
300-
]
301-
}
302-
```
303-
304-
**EventGridNoDeleteListKeysRole.json**: Allow restricted post actions but disallow delete actions.
305-
306-
```json
307-
{
308-
"Name": "Event grid No Delete Listkeys role",
309-
"Id": "B9170838-5F9D-4103-A1DE-60496F7C9174",
310-
"IsCustom": true,
311-
"Description": "Event grid No Delete Listkeys role",
312-
"Actions": [
313-
"Microsoft.EventGrid/*/write",
314-
"Microsoft.EventGrid/eventSubscriptions/getFullUrl/action"
315-
"Microsoft.EventGrid/topics/listkeys/action",
316-
"Microsoft.EventGrid/topics/regenerateKey/action"
317-
],
318-
"NotActions": [
319-
"Microsoft.EventGrid/*/delete"
320-
],
321-
"AssignableScopes": [
322-
"/subscriptions/<Subscription id>"
323-
]
324-
}
325-
```
326-
327-
**EventGridContributorRole.json**: Allows all event grid actions.
328-
329-
```json
330-
{
331-
"Name": "Event grid contributor role",
332-
"Id": "4BA6FB33-2955-491B-A74F-53C9126C9514",
333-
"IsCustom": true,
334-
"Description": "Event grid contributor role",
335-
"Actions": [
336-
"Microsoft.EventGrid/*/write",
337-
"Microsoft.EventGrid/*/delete",
338-
"Microsoft.EventGrid/topics/listkeys/action",
339-
"Microsoft.EventGrid/topics/regenerateKey/action",
340-
"Microsoft.EventGrid/eventSubscriptions/getFullUrl/action"
341-
],
342-
"NotActions": [],
343-
"AssignableScopes": [
344-
"/subscriptions/<Subscription id>"
345-
]
346-
}
347-
```
348-
349-
You can create custom roles with [PowerShell](../role-based-access-control/custom-roles-powershell.md), [Azure CLI](../role-based-access-control/custom-roles-cli.md), and [REST](../role-based-access-control/custom-roles-rest.md).
350-
351188
## Encryption at rest
352189

353-
All events or data written to disk by the Event Grid service is encrypted by a Microsoft-managed key ensuring that it is encrypted at rest. Additionally, the maximum period of time that events or data is retained is 24 hours in adherence with the [Event Grid retry policy](delivery-and-retry.md). Event Grid will automatically delete all events or data after 24 hours, or the event time-to-live, whichever is less.
190+
All events or data written to disk by the Event Grid service is encrypted by a Microsoft-managed key ensuring that it's encrypted at rest. Additionally, the maximum period of time that events or data retained is 24 hours in adherence with the [Event Grid retry policy](delivery-and-retry.md). Event Grid will automatically delete all events or data after 24 hours, or the event time-to-live, whichever is less.
354191

355192
## Next steps
356193

0 commit comments

Comments
 (0)