lab

title	az204Module
Lab: Access resource secrets more securely across services	Module 07: Implement secure cloud solutions

Lab: Access resource secrets more securely across services

Microsoft Azure user interface

Given the dynamic nature of Microsoft cloud tools, you might experience Azure user interface (UI) changes after the development of this training content. These changes might cause the lab instructions and lab steps to not match.

Microsoft updates this training course when the community brings needed changes to our attention; however, because cloud updates occur frequently, you might encounter UI changes before this training content updates. If this occurs, adapt to the changes, and then work through them in the labs as needed.

Instructions

Before you start

Review the installed applications

Find the taskbar on your Windows 10 desktop. The taskbar contains the icons for the applications that you'll use in this lab:

Microsoft Edge
File Explorer

Exercise 1: Create Azure resources

Task 1: Open the Azure portal

On the taskbar, select the Microsoft Edge icon.
In the open browser window, go to the Azure portal (https://portal.azure.com).
Enter the email address for your Microsoft account, and then select Next.
Enter the password for your Microsoft account, and then select Sign in.

Note: If this is your first time signing in to the Azure portal, you will be offered a tour of the portal. If you prefer to skip the tour, select Get Started to begin using the portal.

Task 2: Create an Azure Storage account

In the Azure portal's navigation pane, select All services.
From the All services blade, select Storage Accounts.
From the Storage accounts blade, find your list of Storage instances.
From the Storage accounts blade, select Add.
Find the tabs from the Create storage account blade, such as Basics.

Note: Each tab represents a step in the workflow to create a new storage account. You can select Review + Create at any time to skip the remaining tabs.
From the Basics tab, perform the following actions:
1. Leave the Subscription text box set to its default value.
2. In the Resource group section, select Create new, enter ConfidentialStack, and then select OK.
3. In the Storage account name text box, enter securestor[yourname].
4. In the Location drop-down list, select the (US) East US region.
5. In the Performance section, select Standard.
6. In the Account kind drop-down list, select StorageV2 (general purpose v2).
7. In the Replication drop-down list, select Locally-redundant storage (LRS).
8. Select Review + Create.
From the Review + Create tab, review the options that you selected during the previous steps.
Select Create to create the storage account by using your specified configuration.

Note: Wait for the creation task to complete before you move forward with this lab.
In the Azure portal's navigation pane, select All services.
From the All services blade, select Storage Accounts.
From the Storage accounts blade, select the securestor[yourname] storage account that you created earlier in this lab.
From the Storage account blade, find the Settings section, and then select the Access keys link.
From the Access keys blade, select any one of the keys and record the value in either of the Connection string boxes. You'll use this value later in this lab.

Note: It doesn't matter which connection string you choose. They are interchangeable.

Task 3: Create an Azure Key Vault

In the Azure portal's navigation pane, select the Create a resource link.
From the New blade, find the Search the Marketplace text box above the list of featured services.
In the search box, enter Vault, and then select Enter.
From the Marketplace search results blade, select the Key Vault result.
From the Key Vault blade, select Create.
Find the tabs from the Create key vault blade, such as Basics.

Note: Each tab represents a step in the workflow to create a new key vault. You can select Review + Create at any time to skip the remaining tabs.
From the Basics tab, perform the following actions:
1. Leave the Subscription text box set to its default value.
2. In the Resource group section, select Use existing, and then select ConfidentialStack in the list.
3. In the Key vault name text box, enter securevault[yourname].
4. In the Region drop-down list, select the East US region.
5. In the Pricing tier drop-down list, select Standard.
6. Select Review + Create.
From the Review + Create tab, review the options that you selected during the previous steps.
Select Create to create the key vault by using your specified configuration.

Note: Wait for the creation task to complete before you move forward with this lab.

Task 4: Create an Azure Functions app

In the Azure portal's navigation pane, select the Create a resource link.
From the New blade, find the Search the Marketplace text box above the list of featured services.
In the search box, enter Function, and then select Enter.
From the Marketplace search results blade, select the Function App result.
From the Function App blade, select Create.
Find the tabs from the Function App blade, such as Basics.

Note: Each tab represents a step in the workflow to create a new function app. You can select Review + Create at any time to skip the remaining tabs.
From the Basics tab, perform the following actions:
1. Leave the Subscription text box set to its default value.
2. In the Resource group section, select Use existing, and then select SecureFunction in the list.
3. In the Function app name text box, enter securefunc[yourname].
4. In the Publish section, select Code.
5. In the Runtime stack drop-down list, select Node.js.
6. In the Version drop-down list, select 12.
7. In the Region drop-down list, select the East US region.
8. Select Next: Hosting.
From the Hosting tab, perform the following actions:
1. In the Operating System section, select Linux.
2. In the Storage account drop-down list, select the securestor[yourname] storage account that you created earlier in this lab.
3. In the Plan type drop-down list, select the Consumption (Serverless) option.
4. Select Review + Create.
From the Review + Create tab, review the options that you selected during the previous steps.
Select Create to create the function app by using your specified configuration.

Note: Wait for the creation task to complete before you move forward with this lab.

Review

In this exercise, you created all the resources that you'll use for this lab.

Exercise 2: Configure secrets and identities

Task 1: Configure a system-assigned managed service identity

In the Azure portal's navigation pane, select the Resource groups link.
From the Resource groups blade, find and then select the ConfidentialStack resource group that you created earlier in this lab.
From the ConfidentialStack blade, select the securefunc[yourname] function app that you created earlier in this lab.
From the App Service blade, select the Identity option from the Settings section.
From the Identity pane, find the System assigned tab, and then perform the following actions:
1. In the Status section, select On, and then select Save.
2. In the confirmation dialog box, select Yes.
Note: Wait for the system-assigned managed identity to be created before you move forward with this lab.

Task 2: Create a Key Vault secret

In the Azure portal's navigation pane, select the Resource groups link.
From the Resource groups blade, find and then select the ConfidentialStack resource group that you created earlier in this lab.
From the ConfidentialStack blade, select the securevault[yourname] key vault that you created earlier in this lab.
From the Key Vault blade, select the Secrets link in the Settings section.
In the Secrets pane, select Generate/Import.
From the Create a secret blade, perform the following actions:
1. In the Upload options drop-down list, select Manual.
2. In the Name text box, enter storagecredentials.
3. In the Value text box, enter the storage account connection string that you recorded earlier in this lab.
4. Leave the Content Type text box set to its default value.
5. Leave the Set activation date text box set to its default value.
6. Leave the Set expiration date text box set to its default value.
7. In the Enabled section, select Yes, and then select Create.
Note: Wait for the secret to be created before you move forward with this lab.
Return to the Secrets pane, and then select the storagecredentials item in the list.
In the Versions pane, select the latest version of the storagecredentials secret.
In the Secret Version pane, perform the following actions:
1. Find the metadata for the latest version of the secret.
2. Select Show secret value to find the value of the secret.
3. Record the value of the Secret Identifier text box because you'll use this later in the lab.
Note: You are recording the value of the Secret Identifier text box, not the Secret Value text box.

Task 3: Configure a Key Vault access policy

In the Azure portal's navigation pane, select the Resource groups link.
From the Resource groups blade, find and then select the ConfidentialStack resource group that you created earlier in this lab.
From the ConfidentialStack blade, select the securevault[yourname] key vault that you created earlier in this lab.
From the Key Vault blade, select the Access policies link in the Settings section.
In the Access policies pane, select Add Access Policy.
From the Add access policy blade, perform the following actions:
1. Select the Select principal link.
2. From the Principal blade, find and then select the service principal named securefunc[yourname], and then select Select.
  
  Note: The system-assigned managed identity you created earlier in this lab will have the same name as the Azure Function resource.
3. Leave the Key permissions list set to its default value.
4. In the Secret permissions drop-down list, select the GET permission.
5. Leave the Certificate permissions list set to its default value.
6. Leave the Authorized application text box set to its default value.
7. Select Add.
Back in the Access policies pane, select Save.

Note: Wait for your changes to the access policies to save before you move forward with this lab.

Task 4: Create a Key Vault-derived application setting

In the Azure portal's navigation pane, select the Resource groups link.
From the Resource groups blade, find and then select the ConfidentialStack resource group that you created earlier in this lab.
From the ConfidentialStack blade, select the securefunc[yourname] function app that you created earlier in this lab.
From the App Service blade, select the Configuration option from the Settings section.
From the Configuration pane, perform the following actions:
1. Select the Application settings tab, and then select New application setting.
2. In the Add/Edit application setting pop-up window, in the Name text box, enter StorageConnectionString.
3. In the Value text box, construct a value by using the following syntax: @Microsoft.KeyVault(SecretUri=*Secret Identifier*)
  
  Note: You'll need to build a reference to your Secret Identifier by using the above syntax. For example, if your secret identifier is https://securevaultstudent.vault.azure.net/secrets/storagecredentials/17b41386df3e4191b92f089f5efb4cbf, your value would be @Microsoft.KeyVault(SecretUri=https://securevaultstudent.vault.azure.net/secrets/storagecredentials/17b41386df3e4191b92f089f5efb4cbf).
4. Leave the deployment slot setting text box set to its default value.
5. Select OK to close the pop-up window and return to the Configuration section.
6. Select Save from the blade to save your settings.
7. In the Save Changes confirmation pop-up dialog box, select Continue.
Note: Wait for your application settings to save before you move forward with the lab.
1. In the Save Changes confirmation popup dialog, select Continue.
Note: Wait for your application settings to persist before you move forward with the lab.

Task 2: Create an HTTP-triggered function

In the Azure portal's navigation pane, select the Resource groups link.
From the Resource groups blade, find and then select the SecureFunction resource group that you created earlier in this lab.
From the SecureFunction blade, select the securefunc[yourname] function app that you created earlier in this lab.
From the Function App blade, select the plus sign (+) next to the Functions drop-down list.
In the New Azure Function quickstart, perform the following actions:
1. Under the Choose a Development Environment header, select In-Portal, and then select Continue.
2. Under the Create a Function header, select More templates, and then select Finish and view templates.
3. In the list of templates, select HTTP trigger.
4. In the New Function pop-up window, find the Name text box, and then enter FileParser.
5. In the New Function pop-up window, find the Authorization level list, and then select Anonymous.
6. In the New Function pop-up window, select Create.
In the function editor, find the example function script.

Delete all the example code, and then in the function editor, copy and paste the following placeholder function:

module.exports = async function (context, req) {
    context.log('JavaScript HTTP trigger function processed a request.');

    context.res = {
        body: 'Test Successful'
    };
}

Select Save and run to save the script and perform a test of the function.
The Test and Logs panes will automatically open when the script runs for the first time.

Note: You may notice warning content during compilation in the log. This can be safely ignored.
Find the Output text box in the Test pane. You should now notice the value Test Successful returned from the function.

Task 3: Test the Key Vault-derived application setting

Observe the index.js file method, which should now include:

module.exports = async function (context, req) {
    context.log('JavaScript HTTP trigger function processed a request.');

    context.res = {
        body: 'Test Successful'
    };
}

Add the following line of code to get the value of the StorageConnectionString application setting by using the process.env collection:
```
var connectionString = process.env['StorageConnectionString'];
```
Add the output lines of code to return the value of the connectionString variable:
```
    context.res = {
        body: connectionString
    };
```

Observe the index.js file, which should now include:

module.exports = async function (context, req) {
    context.log('JavaScript HTTP trigger function processed a request.');

    var connectionString = process.env['StorageConnectionString'];

    context.res = {
        body: connectionString
    };
}

Select Save and run to save the script and perform a test of the function.
Find the Output text box in the Test pane. You should now notice the connection string returned from the function.

Review

In this exercise, you used a service identity to read the value of a secret stored in Key Vault and returned that value as the result of an function app.

Exercise 4: Access Azure Blob Storage data

Task 1: Upload a sample storage blob

In the Azure portal's navigation pane, select the Resource groups link.
From the Resource groups blade, find and then select the ConfidentialStack resource group that you created earlier in this lab.
From the ConfidentialStack blade, select the securestor[yourname] storage account that you created earlier in this lab.
From the Storage account blade, select the Containers link in the Blob service section.
In the Containers section, select + Container.
In the New container pop-up window, perform the following actions:
1. In the Name text box, enter drop.
2. In the Public access level drop-down list, select Blob (anonymous read access for blobs only), and then select OK.
Return to the Containers section, and then select the newly created drop container.
From the Container blade, select Upload.
In the Upload blob pop-up window, perform the following actions:
1. In the Files section, select the Folder icon.
2. In the File Explorer window, browse to Allfiles (F):\Allfiles\Labs\07\Starter, select the records.json file, and then select Open.
3. Ensure that Overwrite if files already exist is selected, and then select Upload.
Note: Wait for the blob to upload before you continue with this lab.
Return to the Container blade, and then select the records.json blob in the list of blobs.
From the Blob blade, find the blob metadata, and then copy the URL for the blob.
On the taskbar, right-click the Microsoft Edge icon or activate the shortcut menu, and then select New window.
In the new browser window, go to the URL that you copied for the blob.
The JavaScript Object Notation (JSON) contents of the blob should now display. Close the browser window with the JSON contents.
Return to the browser window with the Azure portal, and then close the Blob blade.
Return to the Container blade, and then select Change access level policy.
In the Change access level pop-up window, perform the following actions:
1. In the Public access level drop-down list, select Private (no anonymous access).
2. Select OK.
On the taskbar, right-click the Microsoft Edge icon or activate the shortcut menu, and then select New window.
In the new browser window, go to the URL that you copied for the blob.
An error message indicating that the resource wasn't found should now display.

Note: If the error message doesn't display, your browser might have cached the file. Press Ctrl+F5 to refresh the page until the error message displays.

Task 2: Pull the storage account SDK from NuGet

In the Azure portal's navigation pane, select the Resource groups link.
From the Resource groups blade, find and then select the SecureFunction resource group that you created earlier in this lab.
From the SecureFunction blade, select the securefunc[yourname] function app that you created earlier in this lab.
From the Function App blade, find and then select the Console to open consol for the function.
Execute following command to generate file package.json:
```
npm init -y
```
The next command should add Azure Blob npm package:
```
npm install @azure/storage-blob
```
Return back to the function code. Add the following line with reference to package in the first line of the file index.js
```
const { BlobServiceClient } = require('@azure/storage-blob');
```

Observe the index.js file, which should now include:

const { BlobServiceClient } = require('@azure/storage-blob');

module.exports = async function (context, req) {
    context.log('JavaScript HTTP trigger function processed a request.');

    var connectionString = process.env['StorageConnectionString'];

    context.res = {
        body: connectionString
    };
}

To test your changes you can run the function again. It should return the same output as previously. It should not return any errors. If you get error check the steps of creation package.js file and include required npm package.

Task 3: Write storage account code

Add the following line of code in the function the value of the StorageConnectionString application setting will be retrieved by using the process.env method:
```
var connectionString = process.env['StorageConnectionString'];
```
Add the following line of code to create a new instance of the class by call BlobServiceClient.fromConnectionString method and passing your connectionString variable to the method:
```
var blobServiceClient = await BlobServiceClient.fromConnectionString(connectionString);
```
Add the following line of code to use the BlobServiceClient.getContainerClient method, while passing in the drop container name to create a new instance of the BlobContainerClient class that references the container that you created earlier in this lab:
```
var containerClient = await blobServiceClient.getContainerClient("drop");
```

Add the following lines of code to use the BlobContainerClient.exists method, while passing reference to drop container to check if the container exists:

    if (await containerClient.exists()) {
         context.res = {
            body: `container found`
        };
    }

Observe the index.js file, which should now include:

const { BlobServiceClient } = require('@azure/storage-blob');

module.exports = async function (context, req) {
    context.log('JavaScript HTTP trigger function processed a request.');

    var connectionString = process.env['StorageConnectionString'];
    var blobServiceClient = await BlobServiceClient.fromConnectionString(connectionString);
    var containerClient = await blobServiceClient.getContainerClient("drop");
    if (await containerClient.exists()) {
         context.res = {
            body: `container found`
        };
    }
}

You can test the function again. IF the container found in the blob you will get appropriate message. If you get empty response or error you should check if the container exists.

Task 4: Download a blob

Add the following line of code to use the BlobServiceClient.getContainerClient() method, while passing in the records.json blob name to create a new instance of the BlockBlobClient class that references the blob that you uploaded earlier in this lab:
```
var blockBlobClient = containerClient.getBlockBlobClient('records.json');
```
Add the following line of code to use the BlockBlobClient.download method to download the contents of the referenced blob asynchronously and store the result in a variable named downloadBlockBlobResponse:
```
var downloadBlockBlobResponse = await blockBlobClient.download(0);
```

Add the following line of code to return the various content stored in the downloadBlockBlobResponse variable by using the additional streamToString function, you can paste the code above the main function:

async function streamToString(readableStream) {
    return new Promise((resolve, reject) => {
        const chunks = [];
        readableStream.on('data', (data) => {
            chunks.push(data.toString());
        });
        readableStream.on('end', () => {
            resolve(chunks.join(''));
        });
        readableStream.on('error', reject);
    });
}

Finlay you need to add call to the streamToString function from the main function and return content as response:

var filecontent = await streamToString(downloadBlockBlobResponse.readableStreamBody);
context.res = {
    body: filecontent
};

Observe the final code:

const { BlobServiceClient } = require('@azure/storage-blob');

async function streamToString(readableStream) {
    return new Promise((resolve, reject) => {
        const chunks = [];
        readableStream.on('data', (data) => {
            chunks.push(data.toString());
        });
        readableStream.on('end', () => {
            resolve(chunks.join(''));
        });
        readableStream.on('error', reject);
    });
}

module.exports = async function (context, req) {
    context.log('JavaScript HTTP trigger function processed a request.');

    var connectionString = process.env['StorageConnectionString'];
    var blobServiceClient = await BlobServiceClient.fromConnectionString(connectionString);
    var containerClient = await blobServiceClient.getContainerClient("drop");
    if (await containerClient.exists()) {
        var blockBlobClient = containerClient.getBlockBlobClient('records.json');
        var downloadBlockBlobResponse = await blockBlobClient.download(0);
        var filecontent = await streamToString(downloadBlockBlobResponse.readableStreamBody);
        context.res = {
            body: filecontent
        };
    }
}

Select Save and run to save the script and perform a test of the function.
Find the Output text box in the Test pane. You should now notice the content of the $/drop/records.json blob stored in your storage account.

Review

In this exercise, you used Node.js code to access a storage account, and then download the contents of a blob.

Exercise 5: Clean up your subscription

Task 1: Open Azure Cloud Shell and list resource groups

In the Azure portal's navigation pane, select the Cloud Shell icon to open a new shell instance.

Note: The Cloud Shell icon is represented by a greater than sign (>) and underscore character (_).
If this is your first time opening Cloud Shell using your subscription, you can use the Welcome to Azure Cloud Shell Wizard to configure Cloud Shell for first-time usage. Perform the following actions in the wizard:
1. A dialog box prompts you to create a new storage account to begin using the shell. Accept the default settings, and then select Create storage.
Note: Wait for Cloud Shell to finish its initial setup procedures before moving forward with the lab. If Cloud Shell configuration options don't display, this is most likely because you are using an existing subscription with this course's labs. The labs are written with the presumption that you are using a new subscription.

Task 2: Delete a resource group

When you receive the command prompt, enter the following command, and then select Enter to delete the ConfidentialStack resource group:
```
az group delete --name ConfidentialStack --no-wait --yes
```
Close the Cloud Shell pane in the portal.

Task 3: Close the active application

Close the currently running Microsoft Edge application.

Review: In this exercise, you cleaned up your subscription by removing the resource groups used in this lab.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AZ-204_07_lab_ak.md

AZ-204_07_lab_ak.md

Lab: Access resource secrets more securely across services

Microsoft Azure user interface

Instructions

Before you start

Review the installed applications

Exercise 1: Create Azure resources

Task 1: Open the Azure portal

Task 2: Create an Azure Storage account

Task 3: Create an Azure Key Vault

Task 4: Create an Azure Functions app

Review

Exercise 2: Configure secrets and identities

Task 1: Configure a system-assigned managed service identity

Task 2: Create a Key Vault secret

Task 3: Configure a Key Vault access policy

Task 4: Create a Key Vault-derived application setting

Task 2: Create an HTTP-triggered function

Task 3: Test the Key Vault-derived application setting

Review

Exercise 4: Access Azure Blob Storage data

Task 1: Upload a sample storage blob

Task 2: Pull the storage account SDK from NuGet

Task 3: Write storage account code

Task 4: Download a blob

Review

Exercise 5: Clean up your subscription

Task 1: Open Azure Cloud Shell and list resource groups

Task 2: Delete a resource group

Task 3: Close the active application

Files

AZ-204_07_lab_ak.md

Latest commit

History

AZ-204_07_lab_ak.md

File metadata and controls

Lab: Access resource secrets more securely across services

Microsoft Azure user interface

Instructions

Before you start

Review the installed applications

Exercise 1: Create Azure resources

Task 1: Open the Azure portal

Task 2: Create an Azure Storage account

Task 3: Create an Azure Key Vault

Task 4: Create an Azure Functions app

Review

Exercise 2: Configure secrets and identities

Task 1: Configure a system-assigned managed service identity

Task 2: Create a Key Vault secret

Task 3: Configure a Key Vault access policy

Task 4: Create a Key Vault-derived application setting

Task 2: Create an HTTP-triggered function

Task 3: Test the Key Vault-derived application setting

Review

Exercise 4: Access Azure Blob Storage data

Task 1: Upload a sample storage blob

Task 2: Pull the storage account SDK from NuGet

Task 3: Write storage account code

Task 4: Download a blob

Review

Exercise 5: Clean up your subscription

Task 1: Open Azure Cloud Shell and list resource groups

Task 2: Delete a resource group

Task 3: Close the active application