compose: migrate database to managed identity

[weikanglim]

Goal: Migrate all databases to only leverage managed identity by default.

Some overall design considerations:

Token vs. passwords

With managed identity, a key exchange is performed to retrieve a short-lived access token. This is different than traditional database passwords which is a pre-negotiated, long-lived key.

This will introduce challenges in the app code consumption, especially in zero-downtime access scenarios.

Examples

• Azure Cache for Redis:

  • Ensure that your client application sends a new Microsoft Entra token at least three minutes before token expiry to avoid connection disruption.
  • When you call the Redis server AUTH command periodically, consider adding a random delay so that the AUTH commands are staggered. In this way, your Redis server doesn't receive too many AUTH commands at the same time.

• Postgres,

  export PGPASSWORD=`curl -s 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fossrdbms-aad.database.windows.net&client_id=CLIENT_ID' -H Metadata:true | jq -r .access_token`
  
  psql -h SERVER --user USER DBNAME

  This password would expire after some time.

• MySql:

  The access token validity is anywhere between 5 minutes to 60 minutes. We recommend you get the access token before initiating the sign-in to Azure Database for MySQL flexible server.

• Cosmos:

  The user is unable to use the existing MongoDB / NoSQL libraries. They must now import CosmosClient and connect to the client. They wouldn't be able, for example, directly use a MongoDB client. It breaks the technology abstraction.

Deployment scripts required

Certain database resource providers require a direct connection to the database to provision Entra objects enabled for Managed identity. This means that an ad-hoc script/operation is required. If we want a fully managed experience, this feature will then depend on operations / scripts as a pre-requisite.

Examples

• For Postgres, the following execution statement is required:

  select * from pgaadauth_create_principal('<identity_name>', false, false);

• For MySql,

  CREATE AADUSER 'user1@yourtenant.onmicrosoft.com';

Keyless vs. Key-based connection

We will likely have to support key-based connections. This is especially important when using existing Azure resources. In these cases, the app developer will not be able to grant themselves permissions to the database.

The important consideration here:

Managed identity is configured on the database server. If the database server isn't fully exposed in configuration, how would a user describe this gesture?

[seesharprun]

@weikanglim

Here's some guidance for Azure Cosmos DB:

• API for NoSQL
  • Use DefaultAzureCredential with CosmosClient
  • I have five quickstart AZD tempaltes that you can use for reference. They all use AVM and Entra auth:
    • azure-samples/cosmos-db-nosql-dotnet-quickstart
    • azure-samples/cosmos-db-nosql-nodejs-quickstart
    • azure-samples/cosmos-db-nosql-python-quickstart
    • azure-samples/cosmos-db-nosql-java-quickstart
    • azure-samples/cosmos-db-nosql-go-quickstart
• API for MongoDB (RU-based)
  • Doesn't support Entra auth
  • Put the connection string in Key Vault
• API for MongoDB (vCore-based)
  • Doesn't support Entra auth
  • Put the connection string in Key Vault
• API for PostgreSQL (RU-based)
  • Supports Entra auth token as an alternative password: https://learn.microsoft.com/azure/cosmos-db/postgresql/concepts-authentication
  • Put the Entra auth token in Key Vault
• API for Cassandra (RU-based)
  • Doesn't support Entra auth
  • Put the connection string in Key Vault
• API for Gremlin
  • Doesn't support Entra auth
  • Put the connection string in Key Vault
• API for Table
  • Use DefaultAzureCredential with TableServiceClient
  • Support has rolled out for two SDKs
    • azure/azure-sdk-for-net/blob/Azure.Data.Tables_12.9.1/sdk/tables/Azure.Data.Tables/CHANGELOG.md#other-changes
    • azure/azure-sdk-for-js/blob/main/sdk/tables/data-tables/CHANGELOG.md#features-added
  • I have two quickstart AZD templates that you can use for reference. They all use AVM and Entra auth:
    • azure-samples/cosmos-db-nosql-dotnet-quickstart
    • azure-samples/cosmos-db-nosql-nodejs-quickstart