Azure Cognitive Services Security Features
Photo by Alberto Rodríguez Santana on Unsplash.
Securing you Azure Cognitive Services Resources
When developing the Azure AI solutions you can secure the Cognitive Services by restricting network access and implementing the secure configurations.
In this post, I will cover some security features such as Managed Identity, the Role-based access control (RBAC), Private Endpoints, and Customer-Managed Keys. Please refer to the Azure security baseline for Cognitive Services for a complete list of the security controls.
Managed Identity
To secure access to the Cognitive Services from other Azure Services, for example, from the web applications and the virtual machines, you can utilize the Managed Identities. When using a Managed Identity the Azure services can authenticate to any service that supports Azure AD authentication without a need to provide or manage any credentials in the code.
If you create an App Service or a Virtual Machine, you can enable a Managed Identity by adding this block to your Terraform code:
identity = {
type = "SystemAssigned"
}
In your ARM templates you can use the following syntax:
"identity": {
"type": "SystemAssigned"
},
You can also create a User-Defined Identity to manage the identity as a separate resource. System-Assigned Managed Identity is created in Azure AD for your resource. However, when the resource is deleted, the identity is deleted as well.
When your App Service has the identity enabled, you can use the Role-based access control to give the required permissions for the web applications using The Principle of Least Privilege.
You can create a role assignment using Terraform or ARM template.
You can find the full list of the roles required to manage the Cognitive Services Accounts here.
Update the application code - Python
You can use ManagedIdentityCredential Class to authenticate your application with an Azure managed identity and get the credentials:
credential = ManagedIdentityCredential()
scope = 'https//cognitiveservices.azure.com/.default'
token = credential.get_token(scope)
To get a token for a storage account, you would need to set a scope https://storage.azure.com/.default. You can find the URI of other Azure services here.
The token can be passed in the REST API call to authenticate the request:
headers = {
'Ocp-Apim-Subscription-Region': <your-region>,
'Authorization': 'Bearer ' + token.token,
'Content-Type': 'application/json',
'X-ClientTraceId': str(uuid.uuid4()),
}
You can find an example of how to get an access token in C# here.
Private Endpoints
To reduce the risks of exposing the Cognitive Services to the public internet you can use the private endpoints. They use an IP address in your virtual network and all communication between the client in the network and your services happens on the Microsoft backbone network. By disabling the public access settings and creating a private endpoint to connect to the Cognitive Service you can secure your solution.
You can find more details on using the private endpoints for the Cognitive Services here.
Create the Private Endpoint using Terraform or the ARM template.
Customer-Managed Keys
Your services are encrypted with Microsoft-managed encryption keys. However, you can use your keys, customer-managed keys (CMK), which you can control through your Azure Key Vault.