In this blog post, we will see one of the ways to secure your Azure Functions using API keys. Security plays a key role as part of SDLC (Software Development Life Cycle) doesn’t matter whether it’s exposed to the client/public or even if it’s internal. There are multiple ways to secure your Azure Functions like API Keys, Certificate, API Mgmt, App Service Authentication, etc. If you are new to the Cloud and Azure Functions but want to make a start with minimal effort and less setup of Infrastructure, then API Keys is the ideal choice.
Azure Functions allows you to secure HTTP-triggered functions by API access key in the request. As part of creating new Azure Functions, we can select the Authorization Level enum value. If we set the Authorisation level to Anonymous, no security applied which means no authentication applied for the endpoint.
Authorization Level — Function
By setting the Authorisation level to Function each Azure Functions require a specific API key to Authorize. Each deployed instance of Azure Function will have its own keys. A Host API key allows access to any function within the function app.
As part of creating Azure Functions with Authorization level — Function, the default key will be created named “default” as shown in the below screenshot. If you want to add your own custom key you can do it by navigating under “Functions” — “Function Keys” blade in the Azure portal. The below screenshot shows both the default key and the custom key (created manually).
Using Postman lets quickly verify. As part of the request passing in the header API Key value for the header name “ x-functions-key” should work for us. As mentioned above you can verify the same using custom API keys or Host key as well.
Authorization Level — Admin
If you are looking for a single API key for all your Azure Functions in the deployment then make use of Authorization Level to Admin.
From the Azure Portal we can set Admin API Keys for all Azure Functions as shown below. Using Postman you can verify the request by passing in the header API Key value for the header name “x-functions-key” should work for us.
References
https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts
Originally published at https://rajurh.blogspot.com on March 8, 2021.
