microsoft / microsoft/aspire

ACA Container volumes use shared access keys

Open
#8,939 4 comments 2 reactions 1 assignee Claimed by @eerhardt View on GitHub
area-deployment azure azure-container-apps Azure.Provisioning external security 🔐
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

When using container volumes in an ACA app, we are generating an Azure Storage account for storing those volumes.

However, the way the access from ACA to this storage account happens is via access keys:

https://github.com/dotnet/aspire/blob/8fd92afd7f3d9168c96f52f147a7b301b78ad349/src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppExtensions.cs#L202-L215

This means that an Azure Storage account is created that allows shared key access, which may trigger security rules in environments that don't want to allow Azure Storage accounts with access keys.

We should be using managed identities here instead, to allow communication between the ACA container and the Storage account.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.