Disable local authentication between Airlock Processor and Azure Service Bus in Function Binding

CHANGELOG.md

@@ -34,10 +34,12 @@ ENHANCEMENTS:
 * Update Guacamole dependencies ([[#4232](https://github.com/microsoft/AzureTRE/issues/4232)])
 * Add option to force tunnel TRE's Firewall ([#4237](https://github.com/microsoft/AzureTRE/issues/4237))
 * Add EventGrid diagnostics to identify airlock issues ([#4258](https://github.com/microsoft/AzureTRE/issues/4258))
+* Disable local authentication in ServiceBus ([#4259](https://github.com/microsoft/AzureTRE/issues/4259))
 * Allow enablement of Secure Boot and vTPM for Guacamole VMs ([#4235](https://github.com/microsoft/AzureTRE/issues/4235))
 * Surface the server-layout parameter of Guacamole [server-layout](https://guacamole.apache.org/doc/gug/configuring-guacamole.html#session-settings) ([#4234](https://github.com/microsoft/AzureTRE/issues/4234))
 * Add encryption at host for VMs ([#4263](https://github.com/microsoft/AzureTRE/pull/4263))
 
+
 BUG FIXES:
 * Update KeyVault references in API to use the version so Terraform cascades the update ([#4112](https://github.com/microsoft/AzureTRE/pull/4112))
 * Template images are showing CVEs ([#4153](https://github.com/microsoft/AzureTRE/issues/4153))

airlock_processor/BlobCreatedTrigger/function.json

@@ -8,7 +8,9 @@
       "direction": "in",
       "topicName": "%BLOB_CREATED_TOPIC_NAME%",
       "subscriptionName": "%TOPIC_SUBSCRIPTION_NAME%",
-      "connection": "SB_CONNECTION_STRING"
+      "connection": "%SERVICEBUS_CONNECTION_NAME%",
+      "accessRights": "listen",
+      "autoComplete": true
     },
     {
       "type": "eventGrid",

airlock_processor/DataDeletionTrigger/function.json

@@ -7,7 +7,9 @@
       "type": "serviceBusTrigger",
       "direction": "in",
       "queueName": "%AIRLOCK_DATA_DELETION_QUEUE_NAME%",
-      "connection": "SB_CONNECTION_STRING"
+      "connection": "%SERVICEBUS_CONNECTION_NAME%",
+      "accessRights": "listen",
+      "autoComplete": true
     }
   ]
 }

airlock_processor/ScanResultTrigger/function.json

@@ -7,7 +7,9 @@
       "type": "serviceBusTrigger",
       "direction": "in",
       "queueName": "%AIRLOCK_SCAN_RESULT_QUEUE_NAME%",
-      "connection": "SB_CONNECTION_STRING"
+      "connection": "%SERVICEBUS_CONNECTION_NAME%",
+      "accessRights": "listen",
+      "autoComplete": true
     },
     {
       "type": "eventGrid",

airlock_processor/StatusChangedQueueTrigger/function.json

@@ -6,7 +6,9 @@
       "type": "serviceBusTrigger",
       "direction": "in",
       "queueName": "%AIRLOCK_STATUS_CHANGED_QUEUE_NAME%",
-      "connection": "SB_CONNECTION_STRING"
+      "connection": "%SERVICEBUS_CONNECTION_NAME%",
+      "accessRights": "listen",
+      "autoComplete": true
     },
     {
       "type": "eventGrid",

airlock_processor/_version.py

@@ -1 +1 @@
-__version__ = "0.8.0"
+__version__ = "0.8.1"

airlock_processor/host.json

@@ -8,7 +8,7 @@
       }
     }
   },
-  "extensionBundle": {
+"extensionBundle": {
     "id": "Microsoft.Azure.Functions.ExtensionBundle",
     "version": "[4.0.0, 5.0.0)"
   }

core/terraform/airlock/airlock_processor.tf

@@ -69,23 +69,27 @@ resource "azurerm_linux_function_app" "airlock_function_app" {
   }
 
   app_settings = {
-    "SB_CONNECTION_STRING"                       = var.airlock_servicebus.default_primary_connection_string
-    "BLOB_CREATED_TOPIC_NAME"                    = azurerm_servicebus_topic.blob_created.name
-    "TOPIC_SUBSCRIPTION_NAME"                    = azurerm_servicebus_subscription.airlock_processor.name
-    "EVENT_GRID_STEP_RESULT_TOPIC_URI_SETTING"   = azurerm_eventgrid_topic.step_result.endpoint
-    "EVENT_GRID_STEP_RESULT_TOPIC_KEY_SETTING"   = azurerm_eventgrid_topic.step_result.primary_access_key
-    "EVENT_GRID_DATA_DELETION_TOPIC_URI_SETTING" = azurerm_eventgrid_topic.data_deletion.endpoint
-    "EVENT_GRID_DATA_DELETION_TOPIC_KEY_SETTING" = azurerm_eventgrid_topic.data_deletion.primary_access_key
-    "WEBSITES_ENABLE_APP_SERVICE_STORAGE"        = false
-    "AIRLOCK_STATUS_CHANGED_QUEUE_NAME"          = local.status_changed_queue_name
-    "AIRLOCK_SCAN_RESULT_QUEUE_NAME"             = local.scan_result_queue_name
-    "AIRLOCK_DATA_DELETION_QUEUE_NAME"           = local.data_deletion_queue_name
-    "ENABLE_MALWARE_SCANNING"                    = var.enable_malware_scanning
-    "ARM_ENVIRONMENT"                            = var.arm_environment
-    "MANAGED_IDENTITY_CLIENT_ID"                 = azurerm_user_assigned_identity.airlock_id.client_id
-    "TRE_ID"                                     = var.tre_id
-    "WEBSITE_CONTENTOVERVNET"                    = 1
-    "STORAGE_ENDPOINT_SUFFIX"                    = module.terraform_azurerm_environment_configuration.storage_suffix
+    "SERVICEBUS_CONNECTION_NAME"                              = local.servicebus_connection
+    "${local.servicebus_connection}__tenantId"                = azurerm_user_assigned_identity.airlock_id.tenant_id
+    "${local.servicebus_connection}__clientId"                = azurerm_user_assigned_identity.airlock_id.client_id
+    "${local.servicebus_connection}__credential"              = "managedidentity"
+    "${local.servicebus_connection}__fullyQualifiedNamespace" = var.airlock_servicebus_fqdn
+    "BLOB_CREATED_TOPIC_NAME"                                 = azurerm_servicebus_topic.blob_created.name
+    "TOPIC_SUBSCRIPTION_NAME"                                 = azurerm_servicebus_subscription.airlock_processor.name
+    "EVENT_GRID_STEP_RESULT_TOPIC_URI_SETTING"                = azurerm_eventgrid_topic.step_result.endpoint
+    "EVENT_GRID_STEP_RESULT_TOPIC_KEY_SETTING"                = azurerm_eventgrid_topic.step_result.primary_access_key
+    "EVENT_GRID_DATA_DELETION_TOPIC_URI_SETTING"              = azurerm_eventgrid_topic.data_deletion.endpoint
+    "EVENT_GRID_DATA_DELETION_TOPIC_KEY_SETTING"              = azurerm_eventgrid_topic.data_deletion.primary_access_key
+    "WEBSITES_ENABLE_APP_SERVICE_STORAGE"                     = false
+    "AIRLOCK_STATUS_CHANGED_QUEUE_NAME"                       = local.status_changed_queue_name
+    "AIRLOCK_SCAN_RESULT_QUEUE_NAME"                          = local.scan_result_queue_name
+    "AIRLOCK_DATA_DELETION_QUEUE_NAME"                        = local.data_deletion_queue_name
+    "ENABLE_MALWARE_SCANNING"                                 = var.enable_malware_scanning
+    "ARM_ENVIRONMENT"                                         = var.arm_environment
+    "MANAGED_IDENTITY_CLIENT_ID"                              = azurerm_user_assigned_identity.airlock_id.client_id
+    "TRE_ID"                                                  = var.tre_id
+    "WEBSITE_CONTENTOVERVNET"                                 = 1
+    "STORAGE_ENDPOINT_SUFFIX"                                 = module.terraform_azurerm_environment_configuration.storage_suffix
   }
 
   site_config {

core/terraform/airlock/locals.tf

@@ -60,4 +60,6 @@ locals {
     azurerm_storage_account.sa_import_in_progress.id,
     azurerm_storage_account.sa_export_approved.id
   ]
+
+  servicebus_connection = "SERVICEBUS_CONNECTION"
 }

core/terraform/airlock/variables.tf

@@ -62,6 +62,9 @@ variable "airlock_servicebus" {
     default_primary_connection_string = string
   })
 }
+variable "airlock_servicebus_fqdn" {
+  type = string
+}
 variable "tre_core_tags" {
   type = map(string)
 }

core/terraform/main.tf

@@ -132,6 +132,7 @@ module "airlock_resources" {
   airlock_app_service_plan_sku          = var.core_app_service_plan_sku
   airlock_processor_subnet_id           = module.network.airlock_processor_subnet_id
   airlock_servicebus                    = azurerm_servicebus_namespace.sb
+  airlock_servicebus_fqdn               = azurerm_servicebus_namespace.sb.endpoint
   applicationinsights_connection_string = module.azure_monitor.app_insights_connection_string
   enable_malware_scanning               = var.enable_airlock_malware_scanning
   arm_environment                       = var.arm_environment

core/terraform/servicebus.tf

@@ -5,6 +5,7 @@ resource "azurerm_servicebus_namespace" "sb" {
   sku                          = "Premium"
   premium_messaging_partitions = "1"
   capacity                     = "1"
+  local_auth_enabled           = false
   tags                         = local.tre_core_tags
 
   # Block public access