Skip to content

[Security] Implement VNet Integration for App Service #24

@emmanuelknafo

Description

@emmanuelknafo

Summary

Configure Virtual Network integration for App Service to enable private connectivity to backend services and restrict network exposure.

Security Benefits

  • App Service can access Key Vault and SQL through private endpoints
  • Reduced attack surface by eliminating public endpoint dependencies
  • Network segmentation between application and data tiers

Current State

  • App Service uses public endpoints for backend connectivity
  • Key Vault relies on Azure Services bypass for access
  • No network isolation between tiers

Acceptance Criteria

  • Virtual Network created with appropriate subnets
  • App Service VNet integration configured
  • Private endpoint created for Key Vault
  • Private endpoint created for SQL Server
  • Key Vault firewall updated with VNet rules
  • Private DNS zones configured for private endpoints
  • Connectivity verified from App Service to all backend services

Implementation Reference

\\�icep
// Virtual Network
resource vnet 'Microsoft.Network/virtualNetworks@2023-11-01' = {
name: 'vnet-'
location: location
properties: {
addressSpace: {
addressPrefixes: ['10.0.0.0/16']
}
subnets: [
{
name: 'snet-app'
properties: {
addressPrefix: '10.0.1.0/24'
delegations: [
{
name: 'delegation'
properties: {
serviceName: 'Microsoft.Web/serverFarms'
}
}
]
}
}
{
name: 'snet-private-endpoints'
properties: {
addressPrefix: '10.0.2.0/24'
}
}
]
}
}

// App Service VNet Integration
resource appServiceVnetConfig 'Microsoft.Web/sites/networkConfig@2023-12-01' = {
parent: appService
name: 'virtualNetwork'
properties: {
subnetResourceId: vnet.properties.subnets[0].id
swiftSupported: true
}
}

// Key Vault Private Endpoint
resource keyVaultPrivateEndpoint 'Microsoft.Network/privateEndpoints@2023-11-01' = {
name: 'pe-kv-'
location: location
properties: {
subnet: {
id: vnet.properties.subnets[1].id
}
privateLinkServiceConnections: [
{
name: 'kv-connection'
properties: {
privateLinkServiceId: keyVault.id
groupIds: ['vault']
}
}
]
}
}
\\

Priority

P2 - High - Implement within 30 days

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions