App Service 인증 및 네트워킹

App Service의 기본 제공 인증

지원되는 ID 공급자

# Enable Microsoft Entra ID authentication via CLI
az webapp auth microsoft update \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --client-id '<Entra-App-Client-ID>' \
  --client-secret '<Client-Secret>' \
  --issuer 'https://sts.windows.net/<TenantId>/'

# Set action when unauthenticated (redirect or 401)
az webapp auth update \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --unauthenticated-client-action RedirectToLoginPage

토큰 저장소 및 사용자 클레임 액세스

// Node.js: read user identity from EasyAuth headers
app.get('/profile', (req, res) => {
  const userName = req.headers['x-ms-client-principal-name'];
  const userId = req.headers['x-ms-client-principal-id'];
  res.json({ name: userName, id: userId });
});

// Or decode the full claims JSON from the header
const principalHeader = req.headers['x-ms-client-principal'];
const claims = JSON.parse(Buffer.from(principalHeader, 'base64').toString());

아웃바운드 트래픽을 위한 VNet 통합

# Enable VNet Integration
az webapp vnet-integration add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --vnet MyVNet \
  --subnet AppServiceSubnet

# Route ALL traffic through the VNet (including internet)
az webapp config appsettings set \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --settings WEBSITE_VNET_ROUTE_ALL=1

인바운드 트래픽을 위한 프라이빗 엔드포인트

# Create a private endpoint for the web app
az network private-endpoint create \
  --name MyWebAppPE \
  --resource-group MyRG \
  --vnet-name MyVNet \
  --subnet PrivateEndpointSubnet \
  --private-connection-resource-id \
    '/subscriptions/.../providers/Microsoft.Web/sites/MyUniqueWebApp' \
  --group-id sites \
  --connection-name MyWebAppConnection

액세스 제한

# Allow only a specific IP range
az webapp config access-restriction add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --priority 100 \
  --action Allow \
  --ip-address 203.0.113.0/24 \
  --rule-name 'OfficeRange'

# Allow Azure Front Door service tag
az webapp config access-restriction add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --priority 200 \
  --action Allow \
  --service-tag AzureFrontDoor.Backend \
  --rule-name 'FrontDoor'

하이브리드 연결

# Add a Hybrid Connection to reach on-prem SQL
az webapp hybrid-connection add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --namespace myServiceBusNS \
  --hybrid-connection on-prem-sql-relay

# The Hybrid Connection Manager agent must be installed
# and configured on the on-premises server to complete the relay

App Service용 관리 ID

# Enable system-assigned managed identity
az webapp identity assign \
  --name MyUniqueWebApp \
  --resource-group MyRG

# Grant the identity access to Key Vault secrets
az keyvault set-policy \
  --name MyKeyVault \
  --object-id $(az webapp identity show \
      --name MyUniqueWebApp \
      --resource-group MyRG \
      --query principalId -o tsv) \
  --secret-permissions get list

CORS 활성화

# Allow specific origin
az webapp cors add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --allowed-origins https://www.contoso.com

# View current CORS settings
az webapp cors show \
  --name MyUniqueWebApp \
  --resource-group MyRG

# Remove a CORS origin
az webapp cors remove \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --allowed-origins https://old.contoso.com

App Service 환경(ASE)

보안 모범 사례 요약

# Enforce HTTPS and minimum TLS version
az webapp update \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --https-only true

az webapp config set \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --min-tls-version '1.2' \
  --ftps-state Disabled

빠른 확인

단원 요약