microsoft / microsoft/aspire

Disable Local Auth on Azure LogAnalyticsWorkspace

Open
#9,797 2 comments 0 reactions 0 assignees View on GitHub
area-integrations azure breaking-change security 🔐
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

We have a goal to disable local auth by default in our Azure integrations and only use managed identity.

`AddAzureLogAnalyticsWorkspace` should set the `OperationalInsightsWorkspace` to have `Features.IsLocalAuthDisabled=true` by default.

https://learn.microsoft.com/en-us/azure/templates/microsoft.operationalinsights/workspaces?pivots=deployment-language-bicep#resource-format

https://github.com/dotnet/aspire/blob/fe64638b9f7bd1f1e3a5ad704f00cf72b24e5162/src/Aspire.Hosting.Azure.OperationalInsights/AzureLogAnalyticsWorkspaceExtensions.cs#L38-L45

We should also disable local auth when we create a Log Analytics Workspace for ACA:

https://github.com/dotnet/aspire/blob/fe64638b9f7bd1f1e3a5ad704f00cf72b24e5162/src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppExtensions.cs#L133-L137

This may require changes to docs or other code.

When doing this, we should verify that ACA and Application Insights works out of the box. If code changes are needed we should add them to our docs.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.