Make Azure Functions not publicly accessible?

10
votes

Currently my functions are accessible publicly. Is there a way to make it so that they can only be accessed via something else, like an API gateway, and not directly? I tried adding a VNET via the "networking" blade but I don't think that did anything (I could still call the functions publicly)...I think that just makes it so the functions could access resources on a private network. I didn't see any options in the settings to make the IP private. I'm not very well versed in networking related issues, so apologies if I'm being unclear.

4
azureazure-functions
I would have used App Service Environment for that but Function App seems not (yet) be available in the "Available App Types" selection - Kai Walter
@KaiWalter Unfortunately Functions isn't listed in that UI, but you just need to do a top level create, choosing "App Service Plan" as the hosting option for the Function App. - lindydonna
See also ... stackoverflow.com/questions/43241431/… - SteveC
And also ... stackoverflow.com/questions/43179256/… - SteveC

4 Answers

11
votes

The built-in keys support is meant to provide an option for this. You can require all requests to include an API key which is only shared with resources you care about. In fact, all HTTP-triggered functions require a key by default. You would have to explicitly choose to remove this requirement.

Keys aren't a networking solution though, and if you leak the keys, someone could access your APIs (until you roll the keys). You are correct that the VNet support is point-to-site, meaning it can access resources, but the function app is not protected itself. An App Service Environment would solve that, although Kai's comment on the original question is correct - ASE is not yet available for Functions.

In addition to keys, you could look at using App Service Authentication / Authorization to require an AAD service principal. This is effectively like a key, but has additional benefits if you are modeling other entities in AAD. Unless you know you need this, though, I would stick with keys.

1
votes

With CORS functionnality you can restrict access to your Azure Function. To configure this, check the following link : Azure Function Settings, at the CORS section.

1
votes

You can apply access restrictions to an Azure Function. The documentation can be found here.

You can use PowerShell AZ module to create a rule (or the portal if you prefer).

Add-AzWebAppAccessRestrictionRule `
    -ResourceGroupName "ResourceGroup" `
    -WebAppName "AppName" `
    -Name "Ip example rule" `
    -Priority 100 `
    -Action Allow `
    -IpAddress 122.133.144.0/24

Docs for Add-AzWebAppAccessRestrictionRule can be found here.

0
votes

IP restrictions can be used to restrict access to whitelisted IPs. You can do it via the the Portal -

https://docs.microsoft.com/en-gb/azure/app-service/app-service-ip-restrictions

or in the web.config with ipSecurity