Implementing platform service network security
Earlier in this chapter, we covered how the Azure firewall or third-party NVAs can be used to protect services within a virtual network. The question here is, what if the service is not in a virtual network? Many platform services, such as Azure Storage and Azure Key Vault, cannot be deployed in an Azure virtual network, so how do we secure them from the network perspective?
Firewall for PaaS services (and firewall exceptions)
By default, platform services have public endpoints that accept connections from clients on any network, and this includes the internet! There is an option to limit that network access by allowing ONLY network traffic originating from specified, trusted IP addresses or IP ranges (Figure 7.19):
Figure 7.19 – Sample firewall rule for an Azure PaaS service
Even though we can configure this restriction for some platform services, we need to be a bit careful with the implementation...
