I'm trying to securely let an Azure App Service connect to an Azure SQL Server Database.
Before, to 'just make it work', I had the SQL Server firewall open to internet. The App Service gets a connection string from the app service, and uses that to connect to .database.windows.net.
So far, I can only see two possibilities:
1) Specifically let the outbound IPs from the App Service through the firewall of the SQL Server. This is risky, as the IPs may change and I have to change them every time it happens.
2) Put SQL Server and App Service in a vnet.
I tried 2), and it kinda failed. I added my vnet to the allowed vnets on the SQL Server firewall's settings, and denied internet connection.
Then I upgraded the App Service from B1 to S1 because apparently my 11€ App Service isn't allowed on a vnet (this is also a reason I'm looking for another solution here).
This worked before, but now I changed some things around to try stuff, and after changing back it doesn't work anymore. I'm not sure why, the settings are the same.
So my problem from the beginning is still here:
How to properly, securely connect an App Service to a SQL Server DB?
So I'm going with the vnet/endpoint solution for now, but it won't work.
- I have the WebAPI in a vnet subnet without NSGs, I can access that from the internet (swagger).
- The vnet has the Service Endpoint Microsoft.Sql activated for that subnet.
- The WebAPI tries to connect to the SQL Serverwith a connection string. I will change this to Azure AD once I get around to learn that. Gotta make the networking work for now.
- The SQL Server Firewall:
- denies public access
- allows azure resource access
- allows access via the subnet. Service Endpoint Status shows enabled.
SQL Server firewall setup: