Why should I use managed identity?

user_679340 0
Viewed 517

What is the benefit of using Managed Identity to access Azure services? What I often see mentioned is that thanks to this you don't commit secrets to configuration files. But I'm deploying all resources using ARM templates and I also don't have any secrets in my configuration files. Settings like connection strings are set during deployment. The only difference I see here is that with Managed Identity even if someone goes to Azure portal he will not be able to get login and password to my DB for example. But this person already has access to my subscription. So is this a problem?

What else do Managed Identities give me?

azure-managed-identity azure-active-directory azure-devops azure
4 Answers

It's not only about the config secrets that are stored or not, it's also about how many secrets need to be stored and managed.
When you create a managed identity, specifically a system-assigned managed identity, no one on your team will have to manage, or even have access to, the secrets related to the identity of the application. The identity is issued, and you are able to provide it access to various resources, such as key vault. No else will be able to use the app's identity take advantage of that access.

If you use a managed service identity in conjunction with something like key vault, you can also more easily limit the number of people that have access to config secrets. You can provide access to the vault to only a few, and still allow others to view/edit the app and its non-secret config.

user_118703350

You're just seeing the happy path. What if an attacker exploit a vulnerability in your app and get the connection string, for example? If you use Managed Identity, he/she won't be able to impersonate your service.

user_13845390

  • Secret/key management. Rotating secrets is best practice. This is done automatically with Managed Identities. Complicated if changing passwords manually/scripting.

  • Secret/key inventory. Makes it easier to see what apps have what permissions.

  • Revoking access. Makes it easy to revoke access for a certain app. Can be scary to revoke access by updating for example a password.

  • Granularity. Giving connection string access to a Storage Account will give full access to everyting in that storage account. By using MI/RBAC on resources it is possible to set for example read access to a specific blob.

user_4875870

why not use encryption in connection string. Managed id sit on machine and can be compromised if some one can access machine.

user_132739860
Related