|
| 1 | +--- |
| 2 | +ms.topic: include |
| 3 | +ms.date: 10/26/2021 |
| 4 | + |
| 5 | +ms.reviewer: madsd |
| 6 | +ms.custom: devx-track-azurecli |
| 7 | +--- |
| 8 | + |
| 9 | +1. Configure the Cognitive Services secrets as app settings `CS_ACCOUNT_NAME` and `CS_ACCOUNT_KEY`. |
| 10 | + |
| 11 | + ```azurecli-interactive |
| 12 | + # Get subscription key for Cognitive Services resource |
| 13 | + csKey1=$(az cognitiveservices account keys list --resource-group $groupName --name $csResourceName --query key1 --output tsv) |
| 14 | +
|
| 15 | + az webapp config appsettings set --resource-group $groupName --name $appName --settings CS_ACCOUNT_NAME="$csResourceName" CS_ACCOUNT_KEY="$csKey1" |
| 16 | + ```` |
| 17 | +
|
| 18 | +1. In the browser, navigate to your deploy app at `<app-name>.azurewebsites.net` and try out the language detector with strings in various languages. |
| 19 | +
|
| 20 | +  |
| 21 | +
|
| 22 | + If you look at the application code, you may notice the debug output for the detection results in the same font color as the background. You can see it by trying to highlight the white space directly below the result. |
| 23 | +
|
| 24 | +## Secure back-end connectivity |
| 25 | +
|
| 26 | +At the moment, connection secrets are stored as app settings in your App Service app. This approach is already securing connection secrets from your application codebase. However, any contributor who can manage your app can also see the app settings. In this step, you move the connection secrets to a key vault, and lock down access so that only you can manage it and only the App Service app can read it using its managed identity. |
| 27 | +
|
| 28 | +1. Create a key vault. Replace *\<vault-name>* with a unique name. |
| 29 | +
|
| 30 | + ```azurecli-interactive |
| 31 | + # Save app name as variable for convenience |
| 32 | + vaultName=<vault-name> |
| 33 | +
|
| 34 | + az keyvault create --resource-group $groupName --name $vaultName --location $region --sku standard --enable-rbac-authorization |
| 35 | + ``` |
| 36 | +
|
| 37 | + The `--enable-rbac-authorization` parameter [sets Azure role-based access control (RBAC) as the permission model](../../../key-vault/general/rbac-guide.md#using-azure-rbac-secret-key-and-certificate-permissions-with-key-vault). This setting by default invalidates all access policies permissions. |
| 38 | +
|
| 39 | +1. Give yourself the *Key Vault Secrets Officer* RBAC role for the vault. |
| 40 | + |
| 41 | + ```azurecli-interactive |
| 42 | + vaultResourceId=$(az keyvault show --name $vaultName --query id --output tsv) |
| 43 | + myId=$(az ad signed-in-user show --query objectId --output tsv) |
| 44 | + az role assignment create --role "Key Vault Secrets Officer" --assignee-object-id $myId --assignee-principal-type User --scope $vaultResourceId |
| 45 | + ``` |
| 46 | +
|
| 47 | +1. Enable the system-assigned managed identity for your app, and give it the *Key Vault Secrets User* RBAC role for the vault. |
| 48 | +
|
| 49 | + ```azurecli-interactive |
| 50 | + az webapp identity assign --resource-group $groupName --name $appName --scope $vaultResourceId --role "Key Vault Secrets User" |
| 51 | + ``` |
| 52 | +
|
| 53 | +1. Add the Cognitive Services resource name and subscription key as secrets to the vault, and save their IDs as environment variables for the next step. |
| 54 | +
|
| 55 | + ```azurecli-interactive |
| 56 | + csResourceKVUri=$(az keyvault secret set --vault-name $vaultName --name csresource --value $csResourceName --query id --output tsv) |
| 57 | + csKeyKVUri=$(az keyvault secret set --vault-name $vaultName --name cskey --value $csKey1 --query id --output tsv) |
| 58 | + ``` |
| 59 | +
|
| 60 | +1. Previously, you set the secrets as app settings `CS_ACCOUNT_NAME` and `CS_ACCOUNT_KEY` in your app. Now, set them as [key vault references](../../app-service-key-vault-references.md) instead. |
| 61 | +
|
| 62 | + ```azurecli-interactive |
| 63 | + az webapp config appsettings set --resource-group $groupName --name $appName --settings CS_ACCOUNT_NAME="@Microsoft.KeyVault(SecretUri=$csResourceKVUri)" CS_ACCOUNT_KEY="@Microsoft.KeyVault(SecretUri=$csKeyKVUri)" |
| 64 | + ``` |
| 65 | +
|
| 66 | +1. In the browser, navigate to `<app-name>.azurewebsites.net` again. If you get detection results back, then you're connecting to the Cognitive Services endpoint with key vault references. |
| 67 | +
|
| 68 | +Congratulations, your app is now connecting to Cognitive Services using secrets kept in your key vault, without any changes to your application code. |
| 69 | +
|
| 70 | +## Clean up resources |
| 71 | +
|
| 72 | +In the preceding steps, you created Azure resources in a resource group. If you don't expect to need these resources in the future, delete the resource group by running the following command in the Cloud Shell: |
| 73 | +
|
| 74 | +```azurecli-interactive |
| 75 | +az group delete --name $groupName |
| 76 | +``` |
| 77 | + |
| 78 | +This command may take a minute to run. |
| 79 | + |
| 80 | +## Next steps |
| 81 | + |
| 82 | +- [Tutorial: Isolate back-end communication with Virtual Network integration](../../tutorial-networking-isolate-vnet.md) |
| 83 | +- [Integrate your app with an Azure virtual network](../../overview-vnet-integration.md) |
| 84 | +- [App Service networking features](../../networking-features.md) |
0 commit comments