Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Azure connection string best practices

I have an application that I am just migrating to Azure. Currently I use web.config transformation to manage changing the database connecting string dev/staging/prod environments. How is it best to manage these multiple connection strings in Azure?

like image 712
Craig Avatar asked Nov 16 '10 03:11

Craig


People also ask

Is it possible to externalize connection strings in azure config?

This externalizing of config also works with the <connectionStrings> section, except you use the configSource attribute like this: When you're deploying a web app to Azure (as often these apps are deployed from source/GitHub, etc) you should NEVER put your connection strings or appSettings in web.config or hard code them.

What is a connection string in azure?

A connection string includes the authentication information required for your application to access data in an Azure Storage account at runtime using Shared Key authorization.

How to connect Azure App service to Azure App configuration store?

1 Through the Azure portal, enter the connection string to your App Configuration store in the Application settings of App Service. 2 Store the connection string to your App Configuration store in Key Vault and reference it from App Service. 3 Use Azure managed identities to access the App Configuration store. ... More items...

Why restrict the SQL Azure account in the connection string?

He has more access to SQL Azure than any other user in the example scenario. Before the connection string is encoded, the SQL Azure administrator needs to restrict the SQL Azure account in the connection string to reduce the attack surface and make the production database more secure.


2 Answers

In cases where it doesn't matter if the developer can see production credentials, you can use the built-in Visual Studio 10 config transformations. If this is what you're looking for, follow these steps:

1.Navigate to your Azure project folder in file explorer
2. Make a copy of ServiceConfiguration.cscfg
3. Rename copy to ServiceConfiguration.Base.cscfg
4. For each build configuration (e.g. Dev, Staging, Production), create a ServiceConfiguration.<build config name>.cscfg file. In these files, you can use the normal config transformation syntax
5. Open your .ccproj file in a text editor
6. Find the following node,

<ItemGroup>     <ServiceDefinition Include="ServiceDefinition.csdef" />     <ServiceConfiguration Include="ServiceConfiguration.cscfg" /> </ItemGroup> 

and replace it with this (you will have to edit this block to match your build configs):

<ItemGroup>     <ServiceDefinition Include="ServiceDefinition.csdef" />     <ServiceConfiguration Include="ServiceConfiguration.cscfg" />     <None Include="ServiceConfiguration.Base.cscfg">         <DependentUpon>ServiceConfiguration.cscfg</DependentUpon>     </None>     <None Include="ServiceConfiguration.Dev.cscfg">         <DependentUpon>ServiceConfiguration.cscfg</DependentUpon>     </None>     <None Include="ServiceConfiguration.Staging.cscfg">         <DependentUpon>ServiceConfiguration.cscfg</DependentUpon>     </None>     <None Include="ServiceConfiguration.Production.cscfg">         <DependentUpon>ServiceConfiguration.cscfg</DependentUpon>     </None> </ItemGroup> 

7.Add the following at the end of the .ccproj file, just above </Project>:

<Import Project="$(MSBuildExtensionsPath)\Microsoft\VisualStudio\v10.0\Web\Microsoft.Web.Publishing.targets" /> <Target Name="BeforeBuild">     <TransformXml Source="ServiceConfiguration.Base.cscfg" Transform="ServiceConfiguration.$(Configuration).cscfg" Destination="ServiceConfiguration.cscfg" /> </Target> 

8.If you're using a CI server that doesn't have Visual Studio 10 installed, you'll probably have to copy the C:\Program Files\MSBuild\Microsoft\VisualStudio\v10.0\Web folder and its contents from a development machine to the server.

Update: As @SolarSteve noted, you might have to add a namespace to your ServiceConfiguration.*.cscfg files. Here's an example of ServiceConfiguration.Base.cscfg:

<sc:ServiceConfiguration serviceName="MyServiceName" osFamily="1" osVersion="*" xmlns:sc="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceConfiguration" xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">   <sc:Role name="MyRoleName">     <sc:Instances count="1" />     <sc:ConfigurationSettings>       <sc:Setting name="DataConnectionString" value="xxx" />     </sc:ConfigurationSettings>   </sc:Role> </sc:ServiceConfiguration> 
like image 165
Jonathan McIntire Avatar answered Sep 27 '22 23:09

Jonathan McIntire


Personally we:

  1. Dropped web config transformations completely.
  2. Setting is retrieved from cscfg.
  3. Development version of cscfg points to local development environment (that's stored in version control).
  4. While deploying to production, we supply secure credentials for production SQL Azure and storage.

For sample of the settings management class that scans application settings and cloud environment for configuration values, you can check out open source Lokad.CQRS for Windows Azure project (see CloudSettingsProvider)

like image 35
Rinat Abdullin Avatar answered Sep 28 '22 00:09

Rinat Abdullin