This repo contains notes I took while following this video series on YouTube.
- Azure App Service
- Azure Kubernetes Service
- Azure Functions
- Application Insights
- Azure SignalR
- Azure SQL
- Key Vault
- Container Registry
- Blob Storage
- Managed Identity
- Azure Container Apps
- App Config
- Cosmos Db
graph TD
A[Enrollment] ---> B["ABC Organization (Tenant aka Directory)<br>For eg: abc.onmicrosoft.com"]
B --> C1["Contoso(Tenant)<br>For eg: contoso.onmicrosoft.com"]
B --> C2["Fabrikam(Tenant)<br>For eg: fabrikam.onmicrosoft.com"]
B ---> C3["Some Saas Non Azure Subscription"] %% Extra "-" to push it down a level
C1 --> D11["Dev Sub"]
C1 --> D12["Prod Sub"]
D11 --> E111["Dev RG1"]
D11 --> E112["Dev RG2"]
D12 --> E121["Prod RGs"]
E111 --> F1111["Resources.<br>For eg: AppService, SqlDb etc."]
E112 --> F1121["..."]
E121 --> F1211["..."]
C2 --> D21["Dev Sub"]
C2 --> D22["Prod Sub"]
D21 --> E211["Dev RGs"]
D22 --> E221["Prod RGs"]
E211 --> F2111["..."]
E221 --> F2211["..."]
C3 --> D31["Office 365"]
C3 --> D32["Dynamics 365"]
D31 --> E311["For eg: 100 E5 licenses"]
D32 --> E321["For eg: 50 licenses"]
classDef hidden display: none;
Note: Users live at Tenant/ Directory level.
- Azure billing and cost management construct for Enterprise Agreement customers. ea.azure.com.
- For large companies.
- Is associated with a single entity, i.e. person, company or org and can own one or several subscriptions.
- In my case, it's a person with domain name: affableashkoutlook.onmicrosoft.com and Organization Id (tenant Id):
9d7f6902-2a61-4363-964c-c464b9eaf716
(Found by going to Settings -> Directories + subscriptions OR Menu -> Azure Active Directory). - Contains user accounts and groups.
- EVERY TENANT IS LINKED TO A SINGLE AZURE AD INSTANCE which is shared with all tenant's subscriptions.
- Each tenant is referred to as an organization.
- I can create multiple tenants after logging in to Azure Portal.
- Directory Id is TenantId because of one to one relationship between tenant and Azure AD.
- The reason it's called directory is because each directory has an Azure AD service associated with it.
- Every MSFT service is always associated with an Azure AD even if we're not using Azure.
- For eg: If I'm using O365, I'll have Azure AD at the top of it.
![image](https://private-user-images.githubusercontent.com/30603497/286764891-019c6117-c1c5-4bde-9da0-e4d022ba2b7c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NjQ4OTEtMDE5YzYxMTctYzFjNS00YmRlLTlkYTAtZTRkMDIyYmEyYjdjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTI2NTllM2NlMTM5ZThhN2ExMTZkNGJmZTM3MzE0OTlmNzQxNzhiNGZiM2ViZWQ4YjA5YTA0NGQ3NmI5ZTE5NDkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.F3mCCBBfdUtZbThdMXt0ijDJ1gUXlpni4_q5HFWNdGQ)
- Construct for creating separate billing and management boundaries. Is managed in portal.azure.com.
- An agreement with MSFT to use one or more MSFT cloud platforms or services for which charges accrue based on either: β Per user license fee. For eg: Saas like Office 365 or Dynamics 365. β Cloud based resource consumption. For eg: Paas and IaaS.
- A subscription is linked to a payment setup and each subscription will result in separate bill.
- Subscription could be CSP (Cloud Service Provider), Pay-As-You-Go, EA etc.
- For customers like Ashish Khanal who can use credit card and do Pay as you go.
- Can create multiple subscriptions in Azure account to create separation.
- A subscription can only be associated with a single Azure AD tenant at any given time.
- Can be linked to existing identity stores for single sign on, or segregated into a separate area.
- Becomes the major separation for assignment of RBAC within services.
- Inside every subscription we can add Resources like VM, SqlDb etc.
- Tenant or Directory has 1:M relationship with Subscription.
- A container that holds related resources.
- Like App Service, Sql Db etc.
- Resources in 1 RG are completely isolated from resources in another RG.
References:
- Subscriptions, licenses, accounts, and tenants
- Tenants and Subscriptions
- Difference between Tenant and Subscription
Go to portal.azure.com. It's pretty self-explanatory.
Follow instructions here.
Follow instructions here.
sudo chown -R $(whoami) /usr/local/var/homebrew
sudo chown -R $(whoami) /usr/local/opt
chmod u+w /usr/local/opt
brew update && brew install azure-cli
az login
![image](https://private-user-images.githubusercontent.com/30603497/286772419-82aadcff-b17b-4f72-8e6b-2def70a6e555.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzI0MTktODJhYWRjZmYtYjE3Yi00ZjcyLThlNmItMmRlZjcwYTZlNTU1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWIwMjNjYjA2NjExYjQwYmUzYzAzYmE4OTcyNTE1MWQwNjJmNjIwY2UxZWM0MmE5NTg0MDBiNzQ4NzAxYmMwYzcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.JsZdNPGzEV0cKR8h_qNf8jaCCCj-N9HOL-_Y3nxPfjI)
Why?
Cloud Shell needs access to manage resources. Access is provided through namespace that must be registered to your subscription.
Get your subscription Id using
az account list (Grab Id)
Then
az account set --subscription <Subscription Name or Id>
az provider register --namespace Microsoft.CloudShell
![image](https://private-user-images.githubusercontent.com/30603497/286765959-a91baa41-f750-4659-a695-c327e4376497.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NjU5NTktYTkxYmFhNDEtZjc1MC00NjU5LWE2OTUtYzMyN2U0Mzc2NDk3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWY1MjlkNTYzOTJmZmJiYTZhMmY5MDRhNzhmODFiZDI0YTI0YTE4Mzk4YWE4NDU3NjI3NDQzMTE3OWRlNjQ1MDMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Jr-dolvGPEvfpkf2tTHK2S5w3KOCaq3GcyIX0D1P9hQ)
Note: tenantId
is my DirectoryId and id
is my SubscriptionID.
Search for Subscription from the search bar:
![image](https://private-user-images.githubusercontent.com/30603497/286766083-9e74b73c-ab1f-4984-b395-886c16f5d583.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NjYwODMtOWU3NGI3M2MtYWIxZi00OTg0LWIzOTUtODg2YzE2ZjVkNTgzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWFmYmRkYjU0MDYxNWQ0NmUxMzJlNWQ3OThmZjdlZDAwODg2NGU5NDU2NjNlN2I5MWE5OTJhYTQ1YTgwOTE5YzgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.wO4aLWFtBHXtfEPJuyiJa4_i-oGeYvDaE-njBSUrnnk)
You can see cost of your services inside the Subscription. Click on the Azure subscription 1 shown above.
![image](https://private-user-images.githubusercontent.com/30603497/286766250-d1ecaf88-2803-4d7a-91f6-4db425fd3559.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NjYyNTAtZDFlY2FmODgtMjgwMy00ZDdhLTkxZjYtNGRiNDI1ZmQzNTU5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWM0ZjYyNDc0MTNhOWJmZjlhZmJlYzI0NTVlYjJhMmJkMzVlOGU5MjY5MmI4ZGYyNzk3OGY4MDMyYzg5MzQ1ZTgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ad-T3-9m8Mi-ART8J7aBfF53LBFhupJ5lngX9yUUYxk)
Create a web app (MunsonPickles.Web
) and an API (MunsonPickles.API
). Take a look at the code to see how they look.
Note about Blazor Web App in .NET 8:
With .NET 8 comes a new template for Blazor applications simply called Blazor Web App
and by default all components use Server-Side-Rendering.
To add interactivity to it, you need to add following service and middleware. More info here.
builder.Services.AddRazorComponents() // π Adds services required to server-side render components. Added by default.
.AddServerComponents(); // π Stuff I added for Server Side Interactivity
app.MapRazorComponents<App>() // π Discovers routable components and sets them up as endpoints. Added by default.
.AddServerRenderMode();// π Stuff I added for Server Side Interactivity
Add interactivity to the new Blazor Web App in .NET 8 using this guide.
Line 13 will create the tables, and line 14 will seed the database.
![image](https://private-user-images.githubusercontent.com/30603497/286772995-2d2cdf2f-ebf0-4fef-8c03-f4f8b33b5333.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzI5OTUtMmQyY2RmMmYtZWJmMC00ZmVmLThjMDMtZjRmOGIzM2I1MzMzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTczNzNmZWQ1MTBmY2U4ZjZhMDI2OTUxNWZhODQ0ZmI2ZjkwODA3ZGYzYmVlMzUzYjUyNTVjNzJlN2E0ZTkwY2UmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.H5vI2p8wpdGRSdhnOw171HQg9qTbMU0VwOS2QvsuTYQ)
Explicit migration is not required in the above approach that looks like
dotnet ef migrations add InitialCreate -o Data/Migrations
dotnet ef database update
So when line db.Database.EnsureCreated()
runs, it'll create the database and the next line will initialize the database.
![image](https://private-user-images.githubusercontent.com/30603497/286774438-e170506f-1fb0-49f4-9f54-5bceba2a6f77.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzQ0MzgtZTE3MDUwNmYtMWZiMC00OWY0LTlmNTQtNWJjZWJhMmE2Zjc3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWYwNTVhODE0OGRmYmRjY2VmMDI0NTBlNTYxMTljN2QwZjlkNWQyNWRiMTY4OWVjYmNjOWMzOTQzYjY0NGQ2MzEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.DxCkTjelpf_0zjkxCkQL5G4NypYLRmRRn2meemFHEeQ)
ashish@Azure:~$ az group create -g rg-pitstop-eastus-dev-001 -l eastus
π
-g
is for resource group name, -l
is for location (Remember RALEIgh).
So the convention that I'll be using is:
ResourceGroup-AppName-Location-Environment-Instance
app-APPNAME-WEB(Because it's a web app)-LOCATION-ENV-INSTANCE
![image](https://private-user-images.githubusercontent.com/30603497/286768891-e9f06473-84b1-4c08-b46b-e5e6f9db36b2.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Njg4OTEtZTlmMDY0NzMtODRiMS00YzA4LWI0NmItZTVlNmY5ZGIzNmIyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFlZWM4MzRhMjllMTBhNmYxZmE3ZDQ1ZjkxNTNkZmQwZDZiNmI1MjhmNWMxYjA1ZDZmODczNjUzZjA2ZjJhNmYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.03sViBeKgkdLN8xjt0XoYh3X6vBERSd3n2kEeTP29zA)
Web app runs on App Service Plan which determines CPU and memory of it.
You can name it like this:
asp-APPNAME-LOCATION-ENV-INSTANCE
asp (App Service Plan)
Notice it doesn't have type like web, api etc. after APPNAME. It's because I want to put both the web app and the web api in that app service plan.
Db Server: sqlserver-munson-eastus-dev-001
![image](https://private-user-images.githubusercontent.com/30603497/286769446-727db0cf-e869-46c0-809d-f21122d699ee.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Njk0NDYtNzI3ZGIwY2YtZTg2OS00NmMwLTgwOWQtZjIxMTIyZDY5OWVlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWYxNmViMmRlZmQ5NWUzNDg3MDNjY2ZkNzBjZDI4N2E3ODVkY2Y4NTg0NzhkYmYyODA3OTMyZGZkNjVhODg0MzUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.uhgn6AS0sgvBPy1xMuz6py_-2Qja5xuciirlm1kplYI)
Allow connections to this SQL server from your IP.
They appear under Firewall rules. Only do this for dev scenarios, NOT for PROD.
![image](https://private-user-images.githubusercontent.com/30603497/286814225-92042627-6f46-4e6c-a0d0-1c59e8831f0b.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY4MTQyMjUtOTIwNDI2MjctNmY0Ni00ZTZjLWEwZDAtMWM1OWU4ODMxZjBiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTJkMDEzODE2ODdkOTg4ZTcyMmIyN2Q2NDlmY2FmN2Q4YzY2ZjRlOWVlMTcyNTFkNTkxMjU3MmIzYzc2M2Y0OTMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.HKU0AC6Xsm4qeg8G6LjTNj-Mx2m6WsBgKjfzXuYhIr8)
And notice that's my IP address:
Db Name: sqldb-munson-eastus-dev-001
Grab connection string (ADO.NET SQL auth):
Server=tcp:sqlserver-munson1-eastus-dev-001.database.windows.net,1433;Initial Catalog=sqldb-munson-eastus-dev-001;Persist Security Info=False;User ID=munson;Password={your_password};
Add this conncection string to dotnet-secrets
.
Set the connection string with this command:
dotnet user-secrets set ConnectionStrings:Default "Server=tcp:sqlserver-munson1-eastus-dev-001.database.windows.net,1433;Initial Catalog=sqldb-munson-eastus-dev-001;Persist Security Info=False;User ID=munson;Password={your_password};"
This will set the connection string like this in the secrets.json:
![image](https://private-user-images.githubusercontent.com/30603497/286770244-7c06cfb3-4502-4060-afed-9a13b0f441ce.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzAyNDQtN2MwNmNmYjMtNDUwMi00MDYwLWFmZWQtOWExM2IwZjQ0MWNlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTA2ODdlMDg0M2E4YzgwZGU1NzhjNzdhYzE1MTI2ZWMyNDQ1YTgwNzIyNmJjNWZkYjVkNjcwZDliNzQ3YTdiNzYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.t8pDuggLzZIm6YJfrTaXyUnSVjI4YH92H7RPNSe8pJY)
It actually looks like this (after installing this plugin):
![image](https://private-user-images.githubusercontent.com/30603497/286770328-b7374a63-8e5b-4eb0-92ed-71e81a4e49a9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzAzMjgtYjczNzRhNjMtOGU1Yi00ZWIwLTkyZWQtNzFlODFhNGU0OWE5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQ0MWMwZmE3NjY0ZTZiMDYzZDA5NzZlYjMyMWFkNjZkYzM5MDA2ZTc2OWJjYmJkZTA3NGIwZDQ4Y2JjZmMwNmQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.KaHITzQxonjeQTQArPTd0XADdLaz6hfUVEzbOmmROlQ)
This is where that file is stored. Reference.
![image](https://private-user-images.githubusercontent.com/30603497/286770479-4e337b64-6ae2-4967-ab06-0e087f486e06.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzA0NzktNGUzMzdiNjQtNmFlMi00OTY3LWFiMDYtMGUwODdmNDg2ZTA2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTNlMjQ3OTk4ZTI5NTk0Nzk2YTU4MTdiZmM2Zjc5ZWVkZmI2ZTFiYTNlM2JmNzIzMDU4YjQ0NTVlZGY4ZjllZGUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.mT-1BALWYWgFyS-flIfjJJyjT40axF5aNpQtbjDhqMg)
Grab the connection string
Server=tcp:sqlserver-munson1-eastus-dev-001.database.windows.net,1433;Initial Catalog=sqldb-munson-eastus-dev-001;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;Authentication="Active Directory Default";
The passwordless connection string includes a configuration value of Authentication=Active Directory Default
, which enables Entity Framework Core to use DefaultAzureCredential
to connect to Azure services. When the app runs locally, it authenticates with the user you're signed into Visual Studio with. Once the app deploys to Azure, the same code discovers and applies the managed identity that is associated with the hosted app, which you'll configure later.
At this point you need to be logged into Azure using Azure CLI (az login
), if you are not logged in, you'll get this exception if you try to run the app:
![image](https://private-user-images.githubusercontent.com/30603497/286773586-8b20fb3a-16eb-4a4f-ae1d-2b98bc98166e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzM1ODYtOGIyMGZiM2EtMTZlYi00YTRmLWFlMWQtMmI5OGJjOTgxNjZlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTliYmIyNTQxOGQ4ZTNjNzcwYzc1Yjk1YzU3OGIzZmFlMGMzMzY5ZjBkODM4NDM4ZGI0MDE4ZDVlNTYxNWIwYTgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.HhC0zFaj2tZ3YzoQ-KjJUGEJ9Wp2a8YDXozWemySFX8)
Azure CLI login is shown here.
So far:
Resource Group: rg-munson-eastus-dev-001
App Service: app-munson-web-eastus-dev-001
App Service Plan: asp-munson-eastus-dev-001
Db Server: sqlserver-munson-eastus-dev-001
Db Name: sqldb-munson-eastus-dev-001
A managed identity from Azure Active Directory (Azure AD) allows App Service to access resources through role-based access control (RBAC), without requiring app credentials. After assigning a managed identity to your web app, Azure takes care of the creation and distribution of a certificate. People don't have to worry about managing secrets or app credentials.
This is secret-less way of doing this, that's why I love it. For eg: No credentials in the connection string.
Any service that supports managed identity (B in the following image) can be securely accessed.
![image](https://private-user-images.githubusercontent.com/30603497/286778133-6b13f2d9-08c4-4527-a09c-4d2fbb07994e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzgxMzMtNmIxM2YyZDktMDhjNC00NTI3LWEwOWMtNGQyZmJiMDc5OTRlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFhNGM2YTkyMjI5NWMyYjgzN2ViODhjOTUyOTAzZTg5MzA5ZWMwMGViMGY1Y2M5YjY3YTRhZjFjNTk5M2ZlMDUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.VwIXmoHo_82B-b9JrQsKmU0zo3_phNNk7VJgMxX2imc)
Internally, managed identities are service principals of a special type which are locked to only be used with Azure resources.
References
![image](https://private-user-images.githubusercontent.com/30603497/287397861-52891608-dfcb-49c0-b7d4-70389946f38a.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODczOTc4NjEtNTI4OTE2MDgtZGZjYi00OWMwLWI3ZDQtNzAzODk5NDZmMzhhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWU4NDlhN2U3ODU0NjdkNjBlM2M3MmFiZjkwMmU1NGMzZDliNjdmZjQ0YTYwOGE5Mjg4NjAxN2QxZDBkM2QzZGUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.5lKjghDppEVqNsz_iFcGPvNniUnCie6K9Qa09LBO14s)
While I'm interacting with my Azure resources, I also talk to my AD to get my token and make requests. Look example here:
![image](https://private-user-images.githubusercontent.com/30603497/286739501-3edd26ca-1a60-4e4b-84c4-bedc3a8d8ab7.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Mzk1MDEtM2VkZDI2Y2EtMWE2MC00ZTRiLTg0YzQtYmVkYzNhOGQ4YWI3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTBhMmI4MzRjODU0YTBlNGZhYTY1ZmI0MWEzYWJiMjk0OGViZjUyNTc4Mzk1YTYyOGRmMTkxNWJlN2YyYWRiNzgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ffPgTXFJ-HMIRW-uRrKmT-Kn8nFhHtYgLAfSAPdsjfM)
Go to Plugins and install Azure Toolkit for Rider.
Go to Tools -> Azure -> Azure Sign In
![image](https://private-user-images.githubusercontent.com/30603497/286775169-f924cf07-fc32-4b6c-9d44-4802e4ee759c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzUxNjktZjkyNGNmMDctZmMzMi00YjZjLTlkNDQtNDgwMmU0ZWU3NTljLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTc3M2MxM2U2NzVlOWU2NTkzY2IxYjAzZTEzYzUyYWFkZDM5YjA2MDIxMzI5MzBhYmRhOGE2ODgzNDY5NDcwZWImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.W3hxO6wgVp2D_vjAR56DpBt2kjQKqIIoz87UHy3samA)
Go with Device Login
![image](https://private-user-images.githubusercontent.com/30603497/286775333-6aae3f62-9011-4093-8dcf-f7443df7203c.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzUzMzMtNmFhZTNmNjItOTAxMS00MDkzLThkY2YtZjc0NDNkZjcyMDNjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTY5OWQ5MzI1OWIyMWZjYjkyYTg0ZTc1OTgyZTRjMWI5Mjc4MDU5NDE5YzRlMjM5MjY2MWY2NGMxZTEzNjFjYjUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.KgBcS3KSf4vAuEQ-fnYBWrekrDLifSHKNNfg_ItNPrM)
Select my Subscription
![image](https://private-user-images.githubusercontent.com/30603497/286775362-e9e2249c-e612-4d49-aea6-bc5c88d24210.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzUzNjItZTllMjI0OWMtZTYxMi00ZDQ5LWFlYTYtYmM1Yzg4ZDI0MjEwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQwMDI2MWUxZTM1MjhmOTkzM2Q5ZjZkMGMyODljN2E3ZGM0YTBlZjQxY2E4OGVmZDAzNWVlMzg2MmZlNjAzNDcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ZN-4fjO6xjjB-FIsgUbo-_W-B4S_5A1ZwGmBuAX7S4Q)
Right click on Project -> Publish -> Azure
![image](https://private-user-images.githubusercontent.com/30603497/286775419-bae42276-638e-47fb-a258-08579fa70acb.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzU0MTktYmFlNDIyNzYtNjM4ZS00N2ZiLWEyNTgtMDg1NzlmYTcwYWNiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQ5Yjg3NDM5NzlhZTllOWI4ZjMyNDVhNWYxNTdmODExMWMxZjY0MmMwZGVhOTdkMWYxMDQxZTI4MjM2ODhhODEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.3wKuAyN1CFeVEOeWi-CWeFjzSxEQc7Ir2--j-3EsYiE)
Select 'Use Existing Web App' and click on the app shown below, like so:
![image](https://private-user-images.githubusercontent.com/30603497/286775452-64f726fc-0f6b-4815-a242-3c9698395b63.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzU0NTItNjRmNzI2ZmMtMGY2Yi00ODE1LWEyNDItM2M5Njk4Mzk1YjYzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTdlNjgwZjlhN2JiOWVmN2ZiNTZiMjVjNjEwMDkxZDYxOTEzODI1MGFhNjQ5MTk2M2IzODRkM2Y1MmYxMjc4ZWEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Dfdhtte1Wu1YvxS7XbVe0ILUZYYYYPjigDR1i05bNR4)
Click Apply -> Run
![image](https://private-user-images.githubusercontent.com/30603497/286775491-1ed99a0b-fe1a-49ae-8881-fbf95be194ea.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzU0OTEtMWVkOTlhMGItZmUxYS00OWFlLTg4ODEtZmJmOTViZTE5NGVhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTMwYzM3NjVmYmRmNjcwYzRlZTdmMjU3MTA5NDA1MmQ1NGY3NjdkYjk0YWU1Y2MyZWRkOGRiNDEzZDc4NGM5OGMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ApALXQmRWWMb_9yOdgIiNoijPxvjp25EDI1aCBlrYeM)
To publish it again, click configuration dropdown in the top right:
![image](https://private-user-images.githubusercontent.com/30603497/286775608-6d3b33bb-6685-4817-aee7-c9c73cde3f42.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzU2MDgtNmQzYjMzYmItNjY4NS00ODE3LWFlZTctYzljNzNjZGUzZjQyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTY2MTNmZjhiZDM1MTFjOGQwNGE2Y2E4MWZmMTZkMDIzNWFmMTk0OWZkOTgzMGI5MTExMmFjODUyN2JhYTg2ZGUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.MdJah0kfBuxrizI6oc7Zb78eKzv2C0qPCnJD83cJBRI)
At this point, the app doesn't work correctly on Azure. You still need to configure the secure connection between the App Service and the SQL database to retrieve your data. Read it all about it here.
![image](https://private-user-images.githubusercontent.com/30603497/286775939-e82e4683-eefa-4186-a31d-903b3df6c77b.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzU5MzktZTgyZTQ2ODMtZWVmYS00MTg2LWEzMWQtOTAzYjNkZjZjNzdiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTI5OGZhN2MzZTMwNTI5YzE4MjNhZjk1ZjdkMTUxMTUyMzQ5NDJhZGExMmY2MjBhMDVmMzU1ZDZlZTM3NTA5YWYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.aLjr_Tajr7CVse6On42YK6wM_TwlwMC47UpNKmjzhi0)
The following steps are required to connect the App Service instance to Azure SQL Database:
- Create a managed identity for the App Service. The
Microsoft.Data.SqlClient
library included in your app will automatically discover the managed identity, just like it discovered your local machine Azure User. - Create a SQL database user and associate it with the App Service managed identity.
- Assign SQL roles to the database user that allow for read, write, and potentially other permissions.
Use Service connector to accomplish this:
Service Connector is a tool that streamlines authenticated connections between different services in Azure. Service Connector currently supports connecting an App Service to a SQL database via the Azure CLI using the az webapp connection create sql
command. This single command completes the three steps mentioned above for you.
Go to Azure Portal and into the app service. You can see that it doesn't have anything under Identity -> System assigned
![image](https://private-user-images.githubusercontent.com/30603497/286776596-c8b94fc3-2072-4de2-8d1b-d71f1048d1b4.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzY1OTYtYzhiOTRmYzMtMjA3Mi00ZGUyLThkMWItZDcxZjEwNDhkMWI0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTc4MzU0YTFkNTM0MDI1ZDMxZGVhMTM4YjYzYmRmODFmZTdkOTQ3OGRkMWY2MGY1ODcxMDY0ZmIwZGU3NDhjZTgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Brfv2L97vSKKJlp4HC7aOoAH9Y9TjWnQcoEuCm-8IDY)
Now run this command (run it in Cloud Shell or Azure CLI):
![image](https://private-user-images.githubusercontent.com/30603497/286776652-6157bb24-c3f7-404c-99e0-51a6e775f037.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzY2NTItNjE1N2JiMjQtYzNmNy00MDRjLTk5ZTAtNTFhNmU3NzVmMDM3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWMxOTJkMGI2YzdjNTk1OWIxMDBlMWY4MTgyMGEyYzllZmU2ZWU2Y2RlOTdlNTZlZDdlOTE0ZDU5MmI4Y2YxMmEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.6BhvUAxKdhut1d04rsK-SMqOomr7ePtZdgsmGyvrSI0)
which translates to:
az webapp connection create sql -g rg-sampleapp-eastus-dev-001 -n app-munson-web2-eastus-dev-001 --tg rg-sampleapp-eastus-dev-001 --server sqlserver-munson1-eastus-dev-001 --database sqldb-munson-eastus-dev-001 --system-identity --connection ThisCanBeAnything --client-type dotnet
At this point, you'll have managed Identity showing:
![image](https://private-user-images.githubusercontent.com/30603497/286776773-e24c0a25-5bda-4eed-a2ea-084936d67b78.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzY3NzMtZTI0YzBhMjUtNWJkYS00ZWVkLWEyZWEtMDg0OTM2ZDY3Yjc4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTViNDkxMjFjZWQxYjhjNzJkMTIzYzk0NjAxMGYyYjllNWExNDllZDIxZjk3MzFlMTc3NTJjNmNmYjQzMDBhMzkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.TnQhZ5B2qYbVJzOWcTQF86jfyDYMFgpcMuC-qW1vm5I)
This connection string created by the above command will show up inside Configuration:
![image](https://private-user-images.githubusercontent.com/30603497/286776868-f532452e-3dfd-441d-a5f2-601df599da80.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzY4NjgtZjUzMjQ1MmUtM2RmZC00NDFkLWE1ZjItNjAxZGY1OTlkYTgwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTg4NjYxNDRkM2MzMDhlNDY5MjQzZGE3NmYxOWYxZmViMDFkYzhjMTk4MTlmMmI5MzQ2ZjQ0NGFjNWFiNzA4YTMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.57HEow74MCpiDqQ6YJ2BuXMYqm2s0U3r2pd6aW_xiLo)
Data Source=sqlserver-munson1-eastus-dev-001.database.windows.net,1433;Initial Catalog=sqldb-munson-eastus-dev-001;Authentication=ActiveDirectoryManagedIdentity
The user should show up in the SQL Db as well
![image](https://private-user-images.githubusercontent.com/30603497/286777411-f0996ebb-9008-42bc-9f5b-4c0822e60d5f.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzc0MTEtZjA5OTZlYmItOTAwOC00MmJjLTlmNWItNGMwODIyZTYwZDVmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTVkMGVjMmM3MDUyZjI4ZjFlY2E5ZmE1MGFlMDMyZjQ4YzAxYWY3NDBjYTljMTg3OTkyYjAxZTEyZmRkOWFiMWImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.3-TXqe9eLnEY04fvb_DAncafj6HjQ5dp87DGP80v2MQ)
Now go to the app url to see your app running.
Unfortunately, it didn't start. :(
![image](https://private-user-images.githubusercontent.com/30603497/286777105-cde49004-fc7b-4eb9-86db-6b639225f2ac.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzcxMDUtY2RlNDkwMDQtZmM3Yi00ZWI5LTg2ZGItNmI2MzkyMjVmMmFjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWZmZWI4NjlmZmU3MDY1YzkzNmJkNmJhODIzYjQwZTNhOWUyMjM3NmQ5YmNmMmZkNjkxOTBjMDQ1MGU4YzUzMDcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.vM-ZY_zDOcbQgfdMKO7J__cPWXXehHM7BO_s1UWkbK8)
Go to App Service -> Diagnose and solve problems -> Availability and Performance
![image](https://private-user-images.githubusercontent.com/30603497/286777169-b1a42b4a-58bd-4703-a3b9-de1cf9ccc08a.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzcxNjktYjFhNDJiNGEtNThiZC00NzAzLWEzYjktZGUxY2Y5Y2NjMDhhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWE0YzhlNzlkNDdlMDEwNjU3YjZlNWMxMzcyOGI4Njk0NDg5OGIyOGEzMzUxZmI0ZWNmM2RiMmM2MWYzOWU4YzUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.TgNcxDLqzWN9YF4o_qWhKsrcHVVCSrBcwruX7HVIm78)
Container crash ->
![image](https://private-user-images.githubusercontent.com/30603497/286777201-d764391b-1a42-435e-8de9-6be3b16df454.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzcyMDEtZDc2NDM5MWItMWE0Mi00MzVlLThkZTktNmJlM2IxNmRmNDU0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTIyMzhlYmQwYzc5ZDliMGVmODA2OGFiZjFhNTQzZTM5MDE4NWU0MzI0MDIxMzU0OThiYWMyZGM1MTE4YTRiNjgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.jPyWv1F_8dsjTyH3Uk3P3Kbtwhy5cVxvXmp1e5KINn0)
UPDATE: Running the command again solved the issue for me:
![image](https://private-user-images.githubusercontent.com/30603497/286777238-6be023dc-be0a-488e-9ef3-ecc087a8271d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzcyMzgtNmJlMDIzZGMtYmUwYS00ODhlLTllZjMtZWNjMDg3YTgyNzFkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTEwODVhZmMxZjg3NWU0YTRiNWI2MmMxM2RkOTk3YjUwMDA3YzYxYTBmMTg0OTM4MTQ4ODg1ZjEyODU0NDBiNGImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.1ALPMzfnLrR0ijsYnemMEilNC46EOZlLY_dh2SLCW8Y)
Now the app runs from Azure! π
![image](https://private-user-images.githubusercontent.com/30603497/286771378-7cf31c4b-433d-49cb-8d7a-37256739be7d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzEzNzgtN2NmMzFjNGItNDMzZC00OWNiLThkN2EtMzcyNTY3MzliZTdkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWIzZmM0MWU2N2ZjMjRhNzdiMGUwNTMwNzk5OTYxZjBjMzFjYmViMDMwODQ4YmE1ZWQ0ZThlZWYzZWMzYmVlYjImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.J9PjQKTtHWlh2Van_wxGEdABP0zQvxfE4izym6KvVDs)
Keep in mind that when you deploy a web app to Azure, it treats it as Production. 'Production' is default if DOTNET_ENVIRONMENT and ASPNETCORE_ENVIRONMENT is not set. Reference.
Environment values set in launchSettings.json
override values set in the system environment. That file is only used on the local dev machine.
A binary large object (blob) is a collection of binary data stored as a single entity. Blobs are typically images, audio or other multimedia objects, though sometimes binary executable code is stored as a blob.
A general purpose v2 storage account provides access to all of the Azure Storage Services: blobs, files, queues, table and disks.
Blobs in Azure storage are organized into containers.
Before we can upload a blob, we must first create a container.
![image](https://private-user-images.githubusercontent.com/30603497/286778734-30d4e933-26d7-4b1d-a040-861203730256.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzg3MzQtMzBkNGU5MzMtMjZkNy00YjFkLWEwNDAtODYxMjAzNzMwMjU2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQwMTU1NGM4ZDljY2ZmNjNmZDQyZjMzYjVmM2Y1NDA3YmU3YzdjZjY4ZWVkOTQxOGIyNzEwYmU5ZjUwZGYyNDMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ReNW6OOag_qRwXAUYn94Q2sWt4CwAKmbBNJ7XHJH4t4)
For eg: I gave 'web' as a name of my folder.
![image](https://private-user-images.githubusercontent.com/30603497/286778827-de1c2ed8-be64-4f18-a36e-5b4254bf00e3.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzg4MjctZGUxYzJlZDgtYmU2NC00ZjE4LWEzNmUtNWI0MjU0YmYwMGUzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQwN2UwNDY1YWEwYjA5NGZhMTBhMWE5Njk2MTk2MTA0ZTNmMDg3MmFiNTgyNzBkN2U4YzFkMWE5NzE5ZDg1MTYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.rP6F1Q__VOYp64RD6aFthe8w-B88YCJsFZ_u05Zgc9c)
The access level of this container is private by default. To change this to public, go to Configuration -> Allow Blob anonymous access -> Enabled -> Save
![image](https://private-user-images.githubusercontent.com/30603497/286778887-611d72b5-1228-4fd2-9746-db8fc7ec0aa5.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzg4ODctNjExZDcyYjUtMTIyOC00ZmQyLTk3NDYtZGI4ZmM3ZWMwYWE1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWRmYzdjZTE5ZjlhMDZjMmQ0NzI4N2I4ZWY5M2NlN2JiMzY2NTg0OTE0MjczMTFhNWQ4OTNiYmRlNzJmYzE0ZDMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.kXZkHjzoDz5bgBd-dIwpzuWa5ccaj5hITcUq0TSOzss)
Now change access level of this container: -> Blob
![image](https://private-user-images.githubusercontent.com/30603497/286778926-5c57644c-35d9-4ca6-96ff-acf0c8ce1bd6.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzg5MjYtNWM1NzY0NGMtMzVkOS00Y2E2LTk2ZmYtYWNmMGM4Y2UxYmQ2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTNlOWJkNjQxOTkxMGViMDBmYTcxZjE2NWQxNTU4N2M4ODYxNTdkODgyNjc5NDU4ZWQwNTdiMWNmNGQwYmFiMjImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.fcgjoSb1WOnyvpF7y_flfuDv_EDGJj_dPNvgpb6vz6g)
We need to grant our web app access to the storage account before we can create, read or delete blobs.
Using Azure RBAC, we can give the managed Identity of the web app access to another Azure resource just like any security principal (User Principal or Service Principal explained earlier in this page).
The 'Storage Blob Contributor' role gives the web app (represented by system assigned managed identity) read, write, and delete access to the blob container and data.
Go to my storage account to grant my web app access to it.
Go to IAM -> Role Assignments This shows who has access to this resource. There's ME!
![image](https://private-user-images.githubusercontent.com/30603497/286779285-ad7ec846-bda5-4d70-adc5-70cee884716e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzkyODUtYWQ3ZWM4NDYtYmRhNS00ZDcwLWFkYzUtNzBjZWU4ODQ3MTZlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQyYTVkZWRkZjVlNjI5NjRiMzcxNWU4OWQ5YmRkZmEyY2IwZGFlYzBiN2QxZjcxODEwOTY4ODU1OTY5MWNiNjAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.JCBEHfyLcjqSWXQwUGBL1Fujqwjth6JvIxdW-Y_DZ-k)
Let's add role assignment to a robot π€ (Managed Identity)
Select Add -> Add role assignment
Search for 'Storage block data contributor' role
![image](https://private-user-images.githubusercontent.com/30603497/286779350-13fea670-12b6-45db-9773-1651317d773e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3NzkzNTAtMTNmZWE2NzAtMTJiNi00NWRiLTk3NzMtMTY1MTMxN2Q3NzNlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWQyN2UzMjBlNzljM2NmZDljNDk1NDE1YzdjMjkxMzEyMGNmNjYxNDI1NWRjNzFhZTU4MDA5ZDZjMThjNmRiMDImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.886MKbMM84vEDUvpdD12th2olZNk5P4Vm1e_mEJI7fE)
Click Next to Select who needs this role
Managed Identity -> Select Members -> Subscription -> App Service (Web App) ->
The managed Identity shows up.
![image](https://private-user-images.githubusercontent.com/30603497/286779415-fdc35ea1-74fc-4db7-a356-7277991eb922.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzk0MTUtZmRjMzVlYTEtNzRmYy00ZGI3LWEzNTYtNzI3Nzk5MWViOTIyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWMxMjgzOWFiZmE3ZGUxOTlkYjI2MGEyMjVmZThhZWY4ZmMxODQ5ZmQxZGU4OThiODA5NzQzODM0MjgwOTY5ZmEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.4tHdTn8k4hcO-_2u9YI1Tbqm70ZM1F5agoz913jpgiE)
Select it and hit Next.
![image](https://private-user-images.githubusercontent.com/30603497/286779440-5f951241-dfd1-4572-a53a-24a912d34e55.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzk0NDAtNWY5NTEyNDEtZGZkMS00NTcyLWE1M2EtMjRhOTEyZDM0ZTU1LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTVmOGFjNWJkOTQxZTEzMWU5OGFhOWQ2YjU5Y2Q1NWJkNWEyY2QwMmE3MmQ2YTAyMDEzM2RmZGEyOTFjMjMzY2MmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.4aduDrC9gWV8XlSVWrrNZEyD0vEo4ZjsA_BP2OKjugk)
Hit 'Review + assign'.
The IAM page looks like this after the assignment:
![image](https://private-user-images.githubusercontent.com/30603497/286779478-5a6c02d4-6607-43b9-aeac-dcfffd40508d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzk0NzgtNWE2YzAyZDQtNjYwNy00M2I5LWFlYWMtZGNmZmZkNDA1MDhkLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVjZjFlNWFlMThmMWViOGU5YTZhMzlhMTQzOTViMWUzNTlmOGUxZWIyNWY4YzM1MDA4ZTlhNTkxODNhZTlhYWUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.5J2SgrL827tzdzhQnnhWgb5Fp2NfCFjavHQKrQfBhVY)
Now go ahead and upload images to 'web' container using Azure portal. It's a simple file upload from your computer. I uploaded few images of pickles and preserves. π
The thing is these images are only available in the eat US. If I try to hit the blob url from Asia, it'll have to make bunch of internet hops to get to it. So what we can do is put a CDN on top of our blob storage.
CDN lives on the Azure edge.
Go to CDN ->
Give Profile name, Endpoint name and specify Query string caching behavior.
Hit create:
![image](https://private-user-images.githubusercontent.com/30603497/286779703-05a1743b-e151-41ea-b586-fa92da8a7c92.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3Nzk3MDMtMDVhMTc0M2ItZTE1MS00MWVhLWI1ODYtZmE5MmRhOGE3YzkyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWM4OGJkNjRiZDg4ZDhkZGU0ZTc4NWI1NTJkODJmMmE4ZDUzMTEzMTdjOGMyYzJhNTBmMzE1NzU2MTZmNzlhNWImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.iAammXm77lg4Qm3Qy24UWIEvt34LgiGXxaZW6bg6PeI)
Go to CDN endpoint now
Grab the endpoint hostname that's served through CDN. Origin hostname is being served through the storage living in eastus.
Notice the urls.
![image](https://private-user-images.githubusercontent.com/30603497/286780231-c4fd5d9b-5535-46a7-8312-63acc54b3fba.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3ODAyMzEtYzRmZDVkOWItNTUzNS00NmE3LTgzMTItNjNhY2M1NGIzZmJhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFhNThlZDVjMmRkZWE4ZGFiNTg2NDM0OTA5ZGFkYzgyZWUwZDA3YzcwZjZjMzJhNGU4OWI4NTZjMGM1NzViZmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.woWv-gO7CMdL404VNxMmzLvgZ-M11f1B_zRRZh2c8HI)
Now grab the endpoint hostname + web + filename and update the db:
![image](https://private-user-images.githubusercontent.com/30603497/286780257-6b2aedeb-402b-4228-8050-041b7b5641e4.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3ODAyNTctNmIyYWVkZWItNDAyYi00MjI4LTgwNTAtMDQxYjdiNTY0MWU0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTYzOThlNDc4NWM0MDQ2Yjg2NjY1NzY0OGEyNjhhZDkzZjIyNTYyYjE1MmY2MjEwYTI2ODBhNDc0Yjc2NzAxODcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.yNJulbpa8EnhQzrwbBwIp0wE2l-3RbgFast61DffDOY)
Update the code to show product photo in a "col" class.
![image](https://private-user-images.githubusercontent.com/30603497/286780299-95a6485b-c99d-4d14-8153-b39655a935df.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3ODAyOTktOTVhNjQ4NWItYzk5ZC00ZDE0LTgxNTMtYjM5NjU1YTkzNWRmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTdlNGM3YzA3NDM4MGEzYjk0OTU5Y2ZkYWJhZDk2ZTYxZGUzOTQwZWRmMDhiYzVlMzU3OTNmNTc3MTI3YTA0ZjEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.WObtqnd4E_xNHd2VZFKaVAZ5IvUsPSOt-Wsm368hfWw)
Now the page looks like this:
![image](https://private-user-images.githubusercontent.com/30603497/286780377-2094e5b2-c78d-40c3-97fd-ea8f2140a061.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY3ODAzNzctMjA5NGU1YjItYzc4ZC00MGMzLTk3ZmQtZWE4ZjIxNDBhMDYxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTc5ODYzMjRhZDA4MGIwZGU1NjI4Y2UwMjU1NWMwODEzOTMyNWZhODZkZGZhYjA0YThkMDMxMTBhNTVkZjJiZGEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ML_qB8PChvogdo4112CWjDRm9BCK42OYSq9jzhUu_mA)
Explanation on Query string caching behavior options:
- Ignore Query String: The first request is served from the origin server and the response is cached. Subsequent requests are served from the cache whatever the query string is. This sounds ludicrous!
Request1: Browser (mydomain.com/articles?page=3) -> Azure CDN -> Server (mydomain.com/articles?page=3) Request2: Browser (mydomain.com/articles?page=42) -> Azure CDN (from cached whatever the query string)
- Bypass caching for query string: Azure CDN doesn't cache the requests that have a query string.
Request1: Browser (mydomain.com/articles?page=3) -> Azure CDN -> Server (mydomain.com/articles?page=3) Request2: Browser (mydomain.com/articles?page=3) -> Azure CDN -> Server (mydomain.com/articles?page=3)
- Use query string: Each request with a unique url including the query string is treated as a unique asset with its own cache.
Request1: Browser (www.example.ashx?q=test1) -> Azure CDN -> Server (www.example.ashx?q=test1) Request2: Browser (www.example.ashx?q=test1) -> Azure CDN (from cache)
The order of the query string parameters doesn't matter. For example, if the Azure CDN environment includes a cached response for the URL www.example.ashx?q=test1&r=test2
, then a request for www.example.ashx?r=test2&q=test1
is also served from the cache.
Now we want to give users the ability to upload images while giving a review of a product.
For this we need Azure SDKs.
Go to Dependencies -> Manage NuGet Packages and add these packages to the project:
Azure.Storage.Blobs
: To work with Blob storage.Microsoft.Extensions.Azure
: Azure client SDK integration withMicrosoft.Extensions
libraries.
For eg: To get this line to work:
To setup connection to Blob. This article helped.
IMPORTANT: (This wasted few hours and caused a lot of frustration)
Your account needs to have Role Assignment to upload files even though I'm the owner.
![image](https://private-user-images.githubusercontent.com/30603497/286814847-c38e272b-4a32-41ad-8bad-a0e8310a20b4.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY4MTQ4NDctYzM4ZTI3MmItNGEzMi00MWFkLThiYWQtYTBlODMxMGEyMGI0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWMyYmU4Y2U1YTEzODE3ZDU2YzE0YWRmMWQ3NzgzOTc3YjhkNjZiNzQ2MDliMTBlMTM2ZThhNmJmMTQ2Njc4ODYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.ASN2rovY3tfFy3G7-gnO3QA35iZZtEzGjPBGzi_DYko)
Your account comes into the picture from DefaultAzureCredential
used to setup the BlobServiceClient
during local development.
Also as you can see in the screenshot above, Azure App Service (Web app) already has access to it through Managed Identity when it runs in the cloud.
![image](https://private-user-images.githubusercontent.com/30603497/286814954-42020bbb-3014-4dbd-b496-caa460629554.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODY4MTQ5NTQtNDIwMjBiYmItMzAxNC00ZGJkLWI0OTYtY2FhNDYwNjI5NTU0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWE2ZTVkOTk1MDcyYjcxNzlhMDQyNzI1ZGU1OWUyMmE0MjgxZTc4NjM3NTgxMDZiNDFmZjIxZWI0M2UwYjllZTEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.9V5GCIeiznlvk5SkxaG4uIpHoEUQPHXnZZh8Te05ntE)
Take a look at the code to see how I implemented file upload using minimal APIs. It's pretty nice!
Everything about adding auth to the app is documented here.
Benefits of containerizing an app:
- All components in a single package.
- Assured new instances the same.
- Quickly spin up new instances.
- Instances can be deployed in many places.
- Helps with agile development because you don't have to pull all the services, you can just work with your "micro" service at a time.
Azure container services:
- Azure Container registry (sort of like Nuget but for images)
- Azure App Service
- Azure Functions
- Azure Container Apps
Abstraction over Kubernetes which is really nice! - Azure Kubernetes Service (AKS)
- Azure Container Instances
Allows to new up containers in the cloud and run them. Not really great for prod scenarios because for eg: if the container goes down, it goes down, no orchestrator to replace it.
For eg: munsonpicklesacr.azurecr.io
dotnet-on-azure/MunsonPickles.API.Dockerfile
Lines 1 to 22 in 1855e45
dotnet-on-azure/MunsonPickles.Web.Dockerfile
Lines 1 to 22 in 1855e45
You can build it in your local computer and push it to the Azure Container Registry (ACR). But for this example, I want to use cloud shell to do this.
Notice that you have docker in there already!
![image](https://private-user-images.githubusercontent.com/30603497/287554014-294b198c-edd7-4e84-822c-0cc9401ebc23.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODc1NTQwMTQtMjk0YjE5OGMtZWRkNy00ZTg0LTgyMmMtMGNjOTQwMWViYzIzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTc1MzEyM2VjZTY0NjU5OTU3NWVmYmNlZDUyOGFkOGYwN2MzMGI4Njk3NjMxY2VhY2E1MTE3MmQzN2E1ZjVhMTYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.vpefxBW5r7CwMJQsZZVgiT56dUgN7eKfVllB8kifKDg)
Steps
- Clone your repo (with Dockerfile checked in)
gh repo clone https://github.com/akhanalcs/dotnet-on-azure.git
- Go to the repo folder
cd ./dotnet-on-azure
- Build and push the image to your Azure Container Registry
It looks similar to building an image locally
az acr build --file MunsonPickles.API.Dockerfile . --image pickles/my-cool-api:0.1.0 --registry munsonpicklesacr.azurecr.io
docker build -f MunsonPickles.API.Dockerfile . -t pickles/my-cool-api:0.1.0
Login to Azure ACR from your computer:
az acr login -n munsonpicklesacr
Pull the image down:
MunsonPicklesACR registry -> Repositories -> find the image -> copy the 'docker pull command'
docker pull munsonpicklesacr.azurecr.io/pickles/my-cool-api:0.1.0
Run the image:
docker run --rm -it -p 8000:8080 -e ASPNETCORE_ENVIRONMENT=Development munsonpicklesacr.azurecr.io/pickles/my-cool-api:0.1.0
Create Web App (Azure App Service)
Name: munson-api-linux-westus
Publish: Docker Container
...
After the deployment is complete, go to munson-api-linux-westus
Web App -> Identity (under Settings)
Turn On 'Managed Identity'.
Now go to MunsonPicklesACR
registry, give access to the managed identity you just created so the web app can pull images from this registry.
Go to Access Control -> Add -> Role Assignment (acr pull) -> Assign access to: managed identity -> choose your app service -> Next -> Review + assign
Now go back to app service to tell it which registry it should go to and which image it should pull.
Go to Deployment Center (under Deployment) -> Settings
Container type: Single container
Registry source: Azure Container Registry
Authentication: Managed Identity
Registry: MunsonPicklesACR
Image: pickles/api
Tag: 0.1.0
-> Save
Restart the web app and take it for a test ride by clicking the url. It should work at this point. π
- Cloud provider manages infrastructure
- Allocates resources as necessary
- Scales down to zero. Reap this benefit by making your function focus on a specific task, and not do a whole lot so when it's free, it can scale down to zero.
- Lets you focus on business logic
- It launches in response to events
- Integrates with other Azure services
- Build a web api
- Process file uploaded to Blob storages
- Respond to database changes
- Process message queues
- Analyze IoT streams
- Real time data with SignalR
- Events that start the function.
- Have incoming data: For eg: let's say a HTTP request that triggered a function. You can get the request body or query string of that request as incoming parameters.
- There are triggers for many different services like:
- HTTP
- Timer
- Storage
- Data
- Event Grid
- etc.
- Connect to another service like Send Grid if you wanted to send emails.
- Input and Output bindings so you can have data come in or you can be writing data to various services.
- Can have multiple bindings per Azure function. For eg: let's say we had a HTTP request coming in that triggered a function, we could have a binding to table storage that pull out data and we can have another binding to let's say blob storage that pulls out a blob and pulls that into your function and do something with it.
Whenever some image (picture) is uploaded, it's going to write a message to an Azure storage queue, once that starts it's going to kick off an Azure function queue trigger. The function runs and it's going to use a table output binding just to write some data to table storage.
![image](https://private-user-images.githubusercontent.com/30603497/287557794-f3abf68a-9d7c-48ad-ae01-f088430d5ae0.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxMDkzMTIsIm5iZiI6MTcyNjEwOTAxMiwicGF0aCI6Ii8zMDYwMzQ5Ny8yODc1NTc3OTQtZjNhYmY2OGEtOWQ3Yy00OGFkLWFlMDEtZjA4ODQzMGQ1YWUwLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDAyNDMzMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVhZGZjZmE5NTNhNjgzOGQ3MjMxMGM1OTM4MGM3ZjkyMThkOWQwY2ZhN2MxYmUxMDRiYzI2NGM1MWYwN2E1ZmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.EFFVnXUHcxdi1cp4yWXKRqsW9A_NWviqtjAl0kfpQfc)
It'll show input binding, trigger and an output table binding.
In MunsonPickles.API
project:
-
Add storage queue SDK. Install
Azure.Storage.Queues
nuget package. -
Add storage queue endpoint url to appsettings.json. It just has
queue
instead ofblob
in the connection string.
For eg: This is my blob storage connection string:"https://stmunsoneastusdev001.blob.core.windows.net/"
, so the queue connection string will be:"https://stmunsoneastusdev001.queue.core.windows.net/"
-
Register it in Program.cs inside
.AddAzureClients
.azureBuilder.AddQueueServiceClient(new Uri(azQueueConnection)) .ConfigureOptions(opts => { opts.MessageEncoding = QueueMessageEncoding.Base64; // Make sure any message I send is base64 encoded });
-
Now go into
ReviewEndpoint.cs
and add logic to write a message to Azure storage queue after an image is uploaded.using Azure.Storage.Queues using Azure.Storage.Queues.Models // Inject QueueServiceClient queueServiceClient into the "UploadReviewImages" method and use it // Get a queue client for queue called "review-images" var queueClient = queueServiceClient.GetQueueClient("review-images"); // Create the queue if it doesn't exist await queueClient.CreateIfNotExistsAsync(PublicAccessType.Blob); // Send a message to the queue await queueClient.SendMessageAsync($"{loggedInUser} {trustedFileNameForStorage}");
-
Run the app, upload an image and go to your storage account in Azure Portal. Go to Storage Browser -> Queues. You'll see a new queue called
review-images
and you'll see a message there. The message body will be in the format:$"{loggedInUser} {trustedFileNameForStorage}"
.
- Create a new Azure Functions project
MunsonPickles.Functions
.- Pick
Queue trigger
which means "hey run it off a queue". - Specify connection string name. For eg: I chose
PickleStorageConnection
. - Specify queue name which is
review-images
from previous step.
- Pick
- Specify connection strings in
local.settings.json
.
When function runs, it needs a storage where it stores its state. It uses a storage account for that, so specify connection string that points to our storage account as the value ofAzureWebJobsStorage
key. In real prod scenario, you should have a separate storage account dedicated to your Functions.{ "IsEncrypted": false, "Values": { "AzureWebJobsStorage": "Put the connection string with Account Name and Account Key", "FUNCTIONS_WORKER_RUNTIME": "dotnet", "PickleStorageConnection": "Put the connection string with Account Name and Account Key" } }
- When a new message comes in to
review-images
storage queue, it'll trigger the below function which writesReviewImageInfo
data toreviewimagedata
table.[StorageAccount("PickleStorageConnection")] public class QueueMonitor { [FunctionName("QueueMonitor")] [return: Table("reviewimagedata")] // If there's no reviewimagedata table present, it'll create it. public ReviewImageInfo Run( [QueueTrigger("review-images")]string message, ILogger log) { // split the message name based on the space var theParts = message.Split(' '); // user id is the first part var userId = theParts[0]; // image name is the second part var imageName = theParts[1]; log.LogInformation($"C# Queue trigger function processed: {message}"); // write to table storage with information about the blob return new ReviewImageInfo { BlobName = "{userId}/{imageName}", PartitionKey = userId, RowKey = Guid.NewGuid().ToString(), UploadedDate = DateTime.Now, ImageName = imageName }; } } public class ReviewImageInfo { public string PartitionKey { get; set; } public string RowKey { get; set; } public string BlobName { get; set; } public string ImageName { get; set; } public string UserId { get; set; } public DateTime UploadedDate { get; set; } }
- Run the function. Go to 'Storage Browser' -> Tables. You'll see a new table
reviewimagedata
that has been populated withReviewImageInfo
.
Github actions is
- CI/CD platform
- Integrated into your GitHub repository
- They are organized into workflows like build and deploy.
- 'Actions' run on events
- Push
- New Issue
- Pull Request
- etc.
- Defined in a YAML file
The components of GitHub actions
- Workflow (on a clean VM)
- The overall process
- Can have more than 1 workflow per repository
- Executes on a "runner" or server
- Server can be a windows, ubuntu or macos VM
- Event
- Triggers a workflow to run
- Many types (push, PR, issue)
- Job
- A grouping of steps (actions) to execute
- Each job will run inside its own virtual machine runner, or inside a container and has one or more steps.
- Action
- Built-in task that performs a common complex task
Create a file in dotnet-on-azure/.github/workflows/deploy-api.yml
dotnet-on-azure/.github/workflows/deploy-api.yaml
Lines 1 to 44 in e621a6e
-
Add profile you downloaded from step 1 to your GitHub repo
- Open the file you downloaded in step 1 using a text editor like notepad, copy it
- Go to your GitHub repo -> Settings -> Secrets and Variables -> Actions
- Under 'Repository secrets', click 'New repository secret', give it a name "API_PUBLISH_PROFILE" and paste the publish profile there
-
Add environment variables
env: AZURE_WEBAPP_NAME: "app-munson-web2-eastus-dev-001" # Copied from App service name
-
It succeeds π
-
Check the app running in Azure App Service by hitting an endpoint
Remember, it came from