Azure Application Insights workspace is a cloud-based service for monitoring and analyzing the performance of applications. It provides real-time insights into the application's behavior, such as request and response times, user behavior, and error rates.
In the past, Azure Application Insights was primarily used programmatically through its web APIs or various SDKs by providing an instrumentation key. This instrumentation key was required to interact with the platform and extract insights about the application's performance or query the data stored in it. However, this experience was limited because it lacked native identity authentication, making it challenging to secure the instrumentation key. Developers had to take extra precautions to secure the key and store it, which added an additional overhead to the development process. This absence of native identity identification made the workplace open to possible security breaches and unauthorized access to data.
Recently, Microsoft has made significant changes to Azure Application Insights Workspace to support Azure Active Directory (Azure AD) authentication. This has enabled developers to opt-out of local authentication and use Managed Identities instead.
By using Managed Identities, telemetry data can be exclusively authenticated using Azure AD, providing a more secure and streamlined way of interacting with the platform. With this change, developers no longer need to worry about managing and storing the instrumentation key securely, as the authentication is handled by Azure AD. This improves the security of the telemetry data and reduces the overhead associated with managing authentication credentials.
This blog post assumes that the reader has a basic understanding of the Azure Active Directory integration enablement for Azure Application Insights Workspace. If not, it will be recommended that you do the reading on MS learn and know details of it and also take a look at feature pre-requisites.
The focus of this blog post is on how to configure Azure AD integration using a Terraform template and validate it using a sample .NET web API that talks to the Application Insights Workspace securely using its managed identity when deployed on an Azure Web App.
Let's take a look at what a terraform template looks like that is responsible for deploying below resources
- Resource group.
- App service plan.
- Web app with it's system assigned managed identity.
- Log analytics workspace along with app insight resource.
- Role assignment to grant required permission to the web app's managed identity on the app insights resource.
| terraform { | |
| required_providers { | |
| azurerm = { | |
| source = "hashicorp/azurerm" | |
| version = "~> 3.0.2" | |
| } | |
| } | |
| required_version = ">= 1.1.0" | |
| } | |
| provider "azurerm" { | |
| features {} | |
| } | |
| resource "azurerm_resource_group" "bgrg" { | |
| name = "az-rg" | |
| location = "centralindia" | |
| } | |
| resource "azurerm_service_plan" "bgasp" { | |
| name = "az-app-svc-plan" | |
| location = azurerm_resource_group.bgrg.location | |
| resource_group_name = azurerm_resource_group.bgrg.name | |
| os_type = "Windows" | |
| sku_name = "F1" | |
| } | |
| resource "azurerm_windows_web_app" "bgwebapp" { | |
| name = "az-web-app-01" | |
| location = azurerm_resource_group.bgrg.location | |
| resource_group_name = azurerm_resource_group.bgrg.name | |
| service_plan_id = azurerm_service_plan.bgasp.id | |
| identity { | |
| type = "SystemAssigned" | |
| } | |
| site_config { | |
| always_on = false | |
| application_stack { | |
| current_stack = "dotnet" | |
| dotnet_version = "v6.0" | |
| } | |
| } | |
| } | |
| resource "azurerm_log_analytics_workspace" "bgla" { | |
| name = "az-la-wp" | |
| location = azurerm_resource_group.bgrg.location | |
| resource_group_name = azurerm_resource_group.bgrg.name | |
| sku = "PerGB2018" | |
| retention_in_days = 30 | |
| } | |
| resource "azurerm_application_insights" "bgwebappai" { | |
| name = "az-ai" | |
| location = azurerm_resource_group.bgrg.location | |
| resource_group_name = azurerm_resource_group.bgrg.name | |
| workspace_id = azurerm_log_analytics_workspace.bgla.id | |
| application_type = "web" | |
| local_authentication_disabled = true | |
| } | |
| resource "azurerm_role_assignment" "bgrbac-mmp" { | |
| scope = azurerm_application_insights.bgwebappai.id | |
| role_definition_name = "Monitoring Metrics Publisher" | |
| principal_id = azurerm_windows_web_app.bgwebapp.identity[0].principal_id | |
| } |
| using Azure.Identity; | |
| using Microsoft.ApplicationInsights.AspNetCore.Extensions; | |
| using Microsoft.ApplicationInsights.Extensibility; | |
| var builder = WebApplication.CreateBuilder(args); | |
| // Add services to the container. | |
| builder.Services.AddControllers(); | |
| // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle | |
| builder.Services.AddEndpointsApiExplorer(); | |
| builder.Services.AddSwaggerGen(); | |
| builder.Services.Configure<TelemetryConfiguration>(config => | |
| { | |
| var credential = new ManagedIdentityCredential(); | |
| config.SetAzureTokenCredential(credential); | |
| }); | |
| builder.Services.AddApplicationInsightsTelemetry(new ApplicationInsightsServiceOptions | |
| { | |
| ConnectionString = "InstrumentationKey=your-app-insight-resource-instru-key-guid;IngestionEndpoint=https://centralindia-0.in.applicationinsights.azure.com/", | |
| DeveloperMode = true | |
| }); | |
| var app = builder.Build(); | |
| // Configure the HTTP request pipeline. | |
| if (app.Environment.IsDevelopment()) | |
| { | |
| app.UseSwagger(); | |
| app.UseSwaggerUI(); | |
| } | |
| app.UseHttpsRedirection(); | |
| app.UseAuthorization(); | |
| app.MapControllers(); | |
| app.Run(); |
