Azure / Azure/data-api-builder
Support Managed Identity for Application Insights in Data API Builder
- Lingua principale
- C#
- Stelle
- 1.5k
- Fork
- 370
- Merge medio
- 3g 22h
- PR unite (30g)
- 9
Descrizione
**Description:**
Currently, Data API Builder does not support using **Managed Identity** for authenticating with **Application Insights**, which introduces security concerns for production workloads. Relying solely on connection strings without AAD support can be considered insecure.
### Proposal
Implement support for using **Managed Identity** when configuring Application Insights, following the same pattern used in **Azure Functions**:
#### Example:
Set the `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` environment variable with either:
- `Authorization=AAD` for system-assigned managed identity
- `Authorization=AAD;ClientId=` for user-assigned identity
This pattern is already well-known in the .NET ecosystem and avoids introducing another authentication standard.
### Implementation Suggestions
- Add a new property to the **configuration JSON schema** and **CLI tooling** to support setting the `APPLICATIONINSIGHTS_AUTHENTICATION_STRING`.
- Ensure proper **unit test coverage** for this configuration.
- Update documentation accordingly to reflect the supported authentication modes for Application Insights.
### Why This Matters
- Aligning with established Azure/.NET standards reduces learning curves for developers.
- Avoids fragmentation or confusion caused by introducing new or inconsistent patterns.
- Enables secure, keyless telemetry integration using Entra ID (formerly Azure AD).
### Related Work
There is an existing issue for supporting a **Log Analytics sink** which mentions **Entra ID** support ([#2709](https://github.com/Azure/data-api-builder/issues/2709)), but:
- It appears unrelated to **Application Insights**.
- It uses a different configuration syntax that doesn’t align with Application Insights’ authentication mechanisms.
I'll need to know if this feature would be accepted by the team before I start working on it.
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Inizia individuando lo schema JSON di configurazione e gli strumenti CLI che definiscono le impostazioni di Application Insights. Esamina gli unit test esistenti per la configurazione e la sezione della documentazione relativa all’autenticazione di Application Insights, quindi conferma con il team le modalità di autenticazione accettate e la sintassi di configurazione prevista. Il lavoro è completato quando schema, CLI, test e documentazione coprono in modo coerente l’autenticazione tramite managed identity.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- azure, csharp
- Ambito
- cloud, observability
- Tipo di issue
- Funzionalità
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 35/100