Connect to an Azure service via User Assigned Managed Identities скачать в хорошем качестве

Connect to an Azure service via User Assigned Managed Identities

User Assigned Managed Identities (UAMI) are more secure and easier to manage than connection strings or account keys. In this show we setup UAMI's to access an Azure Storage Account and KeyVault, plus look at what .Net code changes are required to properly use those Managed Identities. We leverage Copilot to generate most of the required code (both .Net and bicep). Finally, we consider a strategy for managing UAMI's for many Azure resources. LINKS UAMI services: https://learn.microsoft.com/en-us/ent... Principal of Least Privilege: https://en.wikipedia.org/wiki/Princip... 00:01 Intro 00:43 Why UAMI's (User Assigned Managed Identities)? 01:15 UAMI's have their own life cycle 01:35 Can assign a UAMI to multiple services 01:56 Old school way of providing access to a Storage Account 02:46 Summary of what we're going to do in this show 03:47 Create .Net API (just out of the box weather forecast) 04:20 Add code to test connectivity to Storage and KeyVault, using Copilot 05:20 Use Copilot in VS Code (because the result in VS wasn't ideal) 06:15 Check Copilot generated code... 07:53 DefaultAzureCredential 08:41 Create Azure Resources using bicep and Copilot 09:55 Review (scan) Copilot generated bicep and powershell 11:27 Working bicep after resolving a few issues 12:03 Added name for the deployment in the powershell 12:51 For KeyVault's, check the Access Configuration, must be RBAC! [enableRbacAuthorization: true] 14:15 Deploy the API to the Web App 14:49 See the error generated by the API (DefaultAzureCredential failed to retrieve token) 15:09 Create UAMI's and assign roles to provide access (using Copilot) 17:04 One ugly error deploying the bicep "Principal does not exist" (and solution) 17:48 Use "Fix using Copilot" (generally does a good job) 18:23 Examine newly created UAMI's in Azure portal 20:15 After deploying UAMI's, check new error from our API (Unable to load proper Managed Identity) 20:27 Error is occurring because there are TWO UAMI's assigned to our WebApp 20:58 Change .Net code to specify which UAMI to use for each resource 23.17 Where do we get the UAMI Client ID? 24:17 API response after deploying the "specify UAMI" change...works! 26:05 Suggested strategy for implementing UAMI's for many resources. 27:38 Summary