I believe i'm trying to do simple pretty basic with Azure, yet so far I didn't found anything "safe".

Basically, I just want to have a Azure WebApp and a Azure SQL Server (no VMs) communicating to each other, the WebApp been public on internet, and the SQL Server been accessible ONLY by THAT specific webapp.

I found 3 ways to "secure" the communication to an Azure SQL Server:

  1. Allow Azure Services
  2. Whitelisting IP Addresses
  3. Accepting VNet connections

The issues i have with 1, is that anyone that have a azure subscription can reach my DB via multiple components...

With 2, is that the "most secure" is allowing the outbound IPs for the WebApp in the Datacenter, as far as i understand it, anyone could create a WebApp in the same datacenter I choose for my webapp and they will have a chance to be in the same "IP Groups", which means they could reach my DB...

And with 3, maybe it's just me, but went i did that, I could managed to found a way to communicate to my WebApp from Internet...

I believe it's a pretty basic requirement I have...

How do I do it?

Thanks in advances!

  • 1
    FYI, your outbound IP's are not the same for the whole datacentre, they are the same for apps deployed to the same cluster as you. Granted this is >1 but not on the scale of the whole data centre. – Sam Cogan Jan 13 at 18:51
  • Yeah that makes senses , thanks for the precision, but it still a problem – frank Jan 14 at 16:33

You can have more granular network access control if you use Service Endpoints. See our documentation here: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-vnet-service-endpoint-rule-overview

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.