More information about MEAP. Please check here.

Reading Azure Security using liveBook in Manning

I'm choosing to read in liveBook because the liveBook gives me a great reading experience. Anyway, it also provides other formats, such as pdf, epub, and Kindle if you prefer using offline versions. You don't need to worry about the updated versions. You can download the newest version whenever getting updates.

The liveBook allows you to highlight, bookmark, take notes, create discussion, and give feedback about the book content. Those features give you the same experiences when you read on a PDF reader, but it might be better than a PDF reader.

What is the Azure Security?

I am amazed when reading this book, Azure Security. I thought I would be puzzled by technical things and security concepts. But I was wrong! The book gives good illustrations of security concepts. However, it's also balanced between concepts and technical aspects. I can follow the detailed steps and do some hands-on following the books.

This book, Azure Security, has eleven chapters (when I'm writing this post, the book has nine chapters). Each chapter provides a good structure and is well explained. This book has three parts. The first part will give us the fundamental concepts of Azure security. The second part will take us deep into each security aspect of Azure resources. Lastly, we can get more ideas on how to strengthen the security of Azure applications.

Why do I like the Azure Security?

I get some benefits from the Azure Security books. Those benefits are:

1. Azure security aspects in the book are up to date. I like how the books bring us the best concepts and provide the newest product knowledge.

2. Providing good structures and clear steps for each hands-on to secure the Azure resources.

3. Easy to read the explanation for complex concepts. Well explained with illustrations that help us to understand.

4. I love section 4, which covers Azure App Service and Kubernetes, which I use daily. I also love section 5, which covers encryption, great to use in our Azure applications.

Why should you read Azure Security?

I hope you also get the benefits same as me. You can use the liveBook or the offline version like pdf. The completeness of this book will give you a great experience for securing your Azure resources. I'm looking forward to your excitement about this book.

I have good news for you! You can use the 35% discount code (good for all our products in all formats): blberv23

Please refer to the following link: http://mng.bz/6DYe or scan the QR code below

You can use the limited 3 x free eBook codes for Azure Security:

bsbvaz-7B36
bsbvaz-6753
bsbvaz-409D

How to redeem single-use coupon codes

If you don't have a Manning account, you should create one. All orders MUST include a valid email address.

Single-use coupons may be redeemed only once and eBooks are delivered immediately.

>> Book's product page: https://www.manning.com/books/azure-security-2

1. Select “eBook: pdf + ePub + kindle + liveBook.”

2. Click “Add to Cart.”

3. Click “Go to Cart.”

4. Enter your single-use coupon code

5. Click “Apply.”

I want to migrate the portfolio step by step.

1. Create React Project for My Portfolio Web (static web) and host it in AWS Amplify.

2. Prepare the backend using AWS Amplify and migrate my CMS Admin. In short, you can check the project here. I will continue the project in the next part.

3. Connect the data with the React Project.

You can see these images for more information about my migration steps.

• Step 1

• Step 2

• Step 3

What is AWS Amplify?

From my perspective as a Software Engineer or Backend Engineer, this is a tool that helps me to deliver Fullstack Applications into AWS quickly, easily, and user-friendly! Imagine if you need to understand the infrastructure, the delivery pipelines, etc. You might be overthinking about the cloud especially AWS when you want to start hosting your existing website or your initial website. I want to show you how I start using AWS Amplify, but it doesn't mean I use the best practices. Please refer to the documentation for the best practices using AWS Amplify.

Let's Get Started

1. Install Amplify CLI.

2. Because I'm using yarn, please prepare the yarn.

3. Set up the backend part for React.js.

   1. amplify init - Configure my project to connect with AWS Amplify.

   2. yarn add @aws-amplify/ui-react aws-amplify - Add the AWS Amplify library and AWS Amplify UI library to my React project. For more details about the UI library, you can check here.

My Process

1. Coding, of course. I won't share the detailed steps. In short, here are my dependencies,

   1. React Router 6.10.0 - Frontend Routing

   2. aws-amplify 5.0.25 - Will be used for connecting/gathering the data from the backend

   3. @aws-amplify/ui-react 4.6.0 - UI Library

   4. React 18.2.0

   5. React Redux 8.0.5 - Handle theme state

   6. @reduxjs/toolkit 1.9.3

2. I just created the home page. I will move the pages one by one. So, some pages will refer to my previous website.

3. Add hosting: amplify hosting add

   1. Currently, I use manual deployment. However, I will consider using automatic deployment.

   2. Try build: yarn build

   3. For more information about hosting, please check here.

4. Sending PR

   1. Please check here my PR and the changes.

5. Merge PR and prepare to publish manually.

   1. Publish manually: amplify publish

6. My website is ready! Here is the link: https://dev.d2te8gdj4pjzkk.amplifyapp.com

Lesson Learned

It's quite easy to deploy a static website from React! I'm planning to have the backend using AWS Amplify and connect the admin website within it. Of course, the admin website will be hosted in AWS using AWS Amplify!

Please bear with me because I'm so bad at Front-End and Design. Here is a screenshot of my website.

Note:

• Don't forget to add the redirect! Documentation.

Yey! My previous project is alive now! I will continue in the next part. So, stay tuned!

My Repository

https://github.com/bervProject/my-personal-web-react

Thank you!

We will learn how to connect Azure AD with AWS. We will use Azure AD as the identity provider, so Azure AD users will be used to log in to AWS. Let's dive deep into each component.

Azure AD

I will not explain too much about Azure AD. I'll recommend reading the documentation and the home page of the Azure AD. In short, Azure AD (Azure Active Directory) is a cloud-based identity and access management service. You can use the identity provided by Azure AD for connecting various applications or services, including AWS. If you want to learn more about Azure AD, please visit the documentation.

Azure AD SSO with AWS

For connecting Azure AD with AWS, we will need an Enterprise Application. Azure AD has an application gallery to provide a "template" for connecting Azure AD with another SaaS (Software as a Service). Application gallery will help us to create the Enterprise Application, and we can configure the Enterprise Application for single sign-on (SSO) and automated user provisioning. If you want to know more about the application gallery, you might need to read this documentation. But in this post, we will learn to set up the Enterprise Application and configure it for SSO.

We have two approaches to setting up the Enterprise Application. First, we use single AWS Apps to connect multiple AWS Accounts. Last, we create an AWS app for each AWS account.

Single AWS Apps

Single AWS Apps is a model to centralize the configuration, and we only use one Enterprise App to connect multiple AWS Accounts. You will need this approach if you have a small amount of AWS Accounts and roles. We can't configure many AWS Accounts because there is a limitation for the manifest. In contrast, you will need Multiple AWS Apps for the case of large numbers of AWS Accounts.

Multiple AWS Apps

Multiple AWS Apps is a model to map each AWS Account into one AWS Apps. The disadvantage of this model is we need to manage many apps and monitor each app. Other than that, we need to automate of each process to minimize wrong configurations.

Do you imagine how we update the signing certificate for 100 AWS Accounts manually? You will quickly be exhausted and upload the wrong configuration. After that, the SSO doesn't work.

It will become a nightmare if we can't automate the configuration. We are using MS Graph SDK and AWS SDK to solve that problem.

Flow

TLDR

In general, you only need to configure the Enterprise App, download the XML from the Enterprise App, upload the XML to AWS Identity Provider, and configure the roles to use the Identity Provider.

Flow in Technical Term

You might need to see this diagram for details in technical terms.

Repositories

Feel free to check this repository of my project. Please give feedback about this project because this project doesn't fully automate. I plan to have a "save" state and validation of the existing Enterprise App. Currently, the project is assumed to create a new Enterprise App.

Project Details

I use .NET as the main programming language. You can use different languages if you are more familiar with them as long as it's supported by the SDK/library.

I have 3 projects in this repository. The first project is responsible to connect with Microsoft Graph API. The second one is responsible to connect with AWS API. The last one is responsible to manage the business flow to connect both projects.

Azure Integrator

Please see this diagram for the full steps of the Azure Integrator project.

AWS Integrator

Please see this diagram for the full steps of the AWS Integrator project.

For more details, please refer to the documentation in the repository. I will keep the project up to date.

Testing the SSO

1. Go to the myapps.microsoft.com. Click the AWS Icon.

   

2. You will be redirected to AWS Dashboard. Please make sure your role and username are correct.

   

3. On my side, my account is allowed to see the EC2 instances. You can configure the role based on your needs.

   

Thank you

Thank you for reading. Feel free to give feedback for the process, project and this post.

References

Main Resources

Azure AD (AAD)

• Tutorials/Documentations from Microsoft
• Permissions Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, Policy.Read.All, Policy.ReadWrite.ApplicationConfiguration, and User.ReadWrite.All.
• App List Dashboard

AWS

• Simple cross-platform application using the AWS SDK for .NET
• AmazonIdentityManagementServiceClient
• AmazonIdentityManagementServiceClient.CreateSAMLProvider
• AmazonIdentityManagementServiceClient.AttachRolePolicy
• AmazonIdentityManagementServiceClient.CreatePolicy

Setup SSO Manually - Single Account

• https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/amazon-web-service-tutorial

Setup SSO Manually - Multiple Accounts

• https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-multi-accounts-tutorial

Another Topic - Provisioning

• https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-configuration-api

Another Code Samples

• https://learn.microsoft.com/en-us/samples/azure-samples/ms-identity-dotnetcore-galleryapp-management/automate-saml-based-sso-app-configuration-using-ms-graph-api-sdk-net/

Tools/SDK Documentation

• Microsoft Graph Client
• Authentication Provider for MS Graph

Will always work on progress and keep updated! :D

Repository

URL

Want to try?

You can try to register. I don't limit the registration, feel free to test.

Background

I do coding as my hobby. I really love to try and use AWS Services since most of the services are customer friendly. I want to build a forum app to collaborate with excellent software engineers or developers and I like how they post some articles to give some best practices.

I just want to connect with each other and share as caring.

How I Built This?

Install the CLI & Setup Your AWS Account

npm install -g @aws-amplify/cli

Generate the UI Project

npx create-react-app myforumamplify

Generate Backend Amplify Configuration & Install Amplify Library

Reference

Setup Authentication in AWS Amplify Studio

TLDR

Mostly, I wrote the front-end part since the back-end part is quite handy and easy to use, and can be generated!

I want to bring some "guide" how to use AWS SDK .NET, especially using S3. Simple code that you can follow, please navigate to here, in there you will use .NET console.

Preparation

• Please install .NET first. You can choose either .NET 5 or .NET Core 3.1.

https://dotnet.microsoft.com/download

(Optional) .NET 6 currently in the RC stage, if you want to try it.

https://dotnet.microsoft.com/download/dotnet/6.0

• Prepare your project. You can use this command. (if you are already have the project, just skip this step)

dotnet new webapi -o AWSS3Example

Note: In case you can't find the webapi (when use .NET 6), you can use template from .NET 3.1 since in this article using existing project and the existing project using .NET 3.1 and only change the TargetFramework to .net6.0.

• Add AWS SDK S3 to your project. You can use this command.

dotnet add AWSS3Example package AWSSDK.S3

dotnet add AWSS3Example package AWSSDK.Extensions.NETCore.Setup

Note: You can change AWSS3Example with your project name.

• Prepare your AWS Environment and S3

I will not bring many steps. You can follow AWS documentation how to setup. As example, you can follow this (the step before setup project): https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/quick-start-s3-1-cross.html

Coding Time

• I want to write the interface for writing file to S3, so if AWS SDK S3 have major changed, you only change the implementation of the interface. I will write the interface at AWSS3Example/Services/AWS/IAWSS3Service.cs.

using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;

namespace AWSS3Example.Services.AWS
{
  public interface IAWSS3Service
  {
    Task<string> UploadFile(IFormFile formFile);
  }
}

• Write the implementation. Location AWSS3Example/Services/AWS/AWSS3Service.cs.

using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using Amazon.S3;
using Amazon.S3.Model;

namespace AWSS3Example.Services.AWS
{
  public class AWSS3Service : IAWSS3Service
  {
    private IAmazonS3 _s3Client;
    public AWSS3Service(IAmazonS3 amazonS3)
    {
      _s3Client = amazonS3;
    }
    public async Task<string> UploadFile(IFormFile formFile)
    {
      var location = $"uploads/{formFile.FileName}";
      using (var stream = formFile.OpenReadStream())
      {
        var putRequest = new PutObjectRequest
        {
          Key = location,
          BucketName = "upload-test-berv",
          InputStream = stream,
          AutoCloseStream = true,
          ContentType = formFile.ContentType
        };
        var response = await _s3Client.PutObjectAsync(putRequest);
        return location;
      }
    }
  }
}

• Write the controller. I write at AWSS3Example/Controllers/AWSS3Controller.cs.

using System.Threading.Tasks;
using AWSS3Example.Services.AWS;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Http;

namespace AWSS3Example.Controllers
{
  [ApiController]
  [Route("api/[controller]")]
  public class SThreeController : ControllerBase
  {
    private readonly IAWSS3Service _awsS3Service;
    public SThreeController(IAWSS3Service awsS3Service)
    {
      _awsS3Service = awsS3Service;
    }

    [HttpPost("upload")]
    public async Task<IActionResult> Upload([FromForm] IFormFile file)
    {
      var result = await _awsS3Service.UploadFile(uploadFile.File);
      return Ok(new
      {
        path = result
      });
    }
  }
}

• Update the Startup.cs

using Amazon.S3;
using AWSS3Example.Services.AWS;
// ... the rest of another using
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;

namespace AWSS3Example
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            // the rest of another register service ...
            services.AddScoped<IAWSS3Service, AWSS3Service>();
            services.AddAWSService<IAmazonS3>();
            // the rest of another register service ...
            services.AddControllers();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            // the rest of your configure, no need to modify this...
        }
    }
}

• Run your project.

dotnet run --project AWSS3Example

• Test your API

Note: In my case, I use different path, so please use the path that you define at Controller.

• Check your S3

Repository

You can check here for the repository.

Congrats

Congrats. You are finished build API for upload file to AWS S3. Thank you. Hope you enjoy and if have another suggestion, feel free comment in here.

Alternative library that you might be interested: https://github.com/stavro/arc

Preparation

• Make sure you are already install Elixir in your computer/PC.
• Generate new Phoenix Project. (If you are already have the Phoenix Project, you can skip this step).

mix archive.install hex phx_new

mix phx.new elixir_exploration

Note:

1. Phoenix Installation Documentation
2. Phoenix Generate Project

3. Make sure you are already have PostgreSQL, if you not want to use database, please refer to note number 2, how to generate without Ecto which handle the database side.

4. Add Absinthe and ExAWS as Dependencies. Add these to mix.exs

defp deps do
    [
      ... # rest of dependencies, please not input this too
      {:absinthe, "~> 1.6"},
      {:absinthe_plug, "~> 1.5"},
      {:absinthe_phoenix, "~> 2.0"},
      {:ex_aws, "~> 2.2"},
      {:ex_aws_s3, "~> 2.0"},
      {:poison, "~> 3.0"},
      {:hackney, "~> 1.9"},
      {:sweet_xml, "~> 0.6"},
    ]
  end

• Download all deps, use mix deps.get

• Prepare your AWS S3. :) Please read more in their documentation. https://aws.amazon.com/s3/

• Prepare your account, we will use AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Please visit here for more information about ExAWS: https://github.com/ex-aws/ex_aws

Let's Code

My code structure will be like this:

- root
-- elixir_exploration
-- elixir_exploration_web
--- resolvers # store all GraphQL resolvers
--- schema # store all GraphQL schemas
-- schema.ex # store all GraphQL query/mutations

• I will code at GraphQL side first (Absinthe). Please setup the Absinthe first.

You can refer this guide: https://hexdocs.pm/absinthe/plug-phoenix.html

I really love most of popular library, they bring us a nice guide. :)

• Write the resolver, I will put in elixir_exploration_web/resolvers/uploads.ex

defmodule ElixirExplorationWeb.Resolvers.Uploads do
  alias ExAws.S3

  def upload_to_aws(_, %{input: input}, _) do
    IO.inspect(input.file)
    request = input.file.path
      |> S3.Upload.stream_file()
      # take care the filename, you should validate this
      |> S3.upload("upload-test-berv", "uploads/#{input.file.filename}")
      |> ExAws.request()
    case request do
      {:ok, _} -> {:ok, "Success"}
      {:error, _} -> {:error, "Please try again"}
    end
  end
end

Don't forget to update the bucket name. In that example, I use upload-test-berv as the bucket name. I use uploads/#{input.file.filename} as the target file location.

• Write the schema, I will put in elixir_exploration_web/schema/upload_types.ex

defmodule ElixirExplorationWeb.Schema.UploadTypes do
  use Absinthe.Schema.Notation

  alias ElixirExplorationWeb.Resolvers
  import_types(Absinthe.Plug.Types)

  object :upload_file do
    @desc """
      Upload a file
    """
    field :upload_file, :string do
      arg(:input, non_null(:file_input))
      resolve(&Resolvers.Uploads.upload_to_aws/3)
    end
  end

  input_object :file_input do
    field :file, non_null(:upload)
  end
end

• Import those files into elixir_exploration_web/schema.ex

defmodule ElixirExplorationWeb.Schema do
  use Absinthe.Schema

  alias ElixirExplorationWeb.Schema

  import_types(Schema.UploadTypes)

  query do

  end

  mutation do
    import_fields(:upload_file)
  end
end

• Update config, I want to setup the default region. Currently I update to config/config.exs, but feel free to add different approach for different env.

config :ex_aws,
  region: {:system, "AWS_DEFAULT_REGION"}

• Write the env.sh, this for setup our environment variable in our system.

export AWS_ACCESS_KEY_ID=<your_access_key_id>
export AWS_SECRET_ACCESS_KEY=<your_secret_access_key>
export AWS_DEFAULT_REGION=ap-southeast-1

Feel free to use another region. :)

• Apply the environment, you can use source env.sh.

• Run your Phoenix Server. mix phx.server

• Test your API. Because my API locate at localhost:4000/api/graphql, so I will use that. If you set another path, please update it from my script below.

curl -X POST -F query="mutation { uploadFile(input: {file: \"my_data\"})}" -F my_data=@mix.exs -H "Accept:application/json" localhost:4000/api/graphql

• Check your S3

My Repo

You also can visit my repositories. I will write more in there if I have any updates.

Congrats

Yey! Congrats! You've implemented file upload and upload the file to AWS S3. In the next section, maybe I will write to show the result after you upload the file. The approach I will use:

1. Use database as the listing
2. Call AWS S3 API Directly to get the list

I hope I will write in the next month and write each approach in different article.

Thank you. :)

Hello, I am new at Elixir and Phoenix. I curious about DevOps aspects and Backend aspects. So, that is why I explore more about coverage report and automatic testing. I found great alternative about coverage report, that is ExCoveralls.

Setup ExCoveralls to Existing Phoenix Project

You can check the settings section of ExCoveralls, here. Please refer to their newest settings, this settings might be outdated for later.

• Add this to project at mix.exs.

def project do
  [
    ..., # existing settings
    deps: deps(),
    test_coverage: [tool: ExCoveralls],
    preferred_cli_env: [
      coveralls: :test,
      "coveralls.detail": :test,
      "coveralls.post": :test,
      "coveralls.html": :test
    ]
    # if you want to use espec,
    # test_coverage: [tool: ExCoveralls, test_task: "espec"]
  ]
end

• Add this to deps at mix.exs

defp deps do
  [
    ..., # existing dependencies
    {:excoveralls, "~> 0.10", only: :test},
  ]
end

• Create new file with name coveralls.json in the root project. This settings to ignore test and deps folder become coverage area.

{
  "skip_files": [
    "test",
    "deps"
  ]
}

• To test if it's already installed and works. You can run this command.

MIX_ENV=test mix coveralls

Setup Github Action

I use Github Action as my main CI/CD platform. Currently I use this configuration.

name: Elixir CI
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
jobs:
  build:
    name: Build and test
    runs-on: ubuntu-20.04
    services:
      # Label used to access the service container
      postgres:
        # Docker Hub image
        image: postgres:13-alpine
        # Provide the password for postgres
        env:
          POSTGRES_PASSWORD: postgres
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          # Maps tcp port 5432 on service container to the host
          - 5432:5432
    steps:
    - uses: actions/checkout@v2
    - uses: erlef/setup-beam@v1
      with:
        otp-version: '22.2'
        elixir-version: '1.10'
    - name: Restore dependencies cache
      uses: actions/cache@v2
      with:
        path: deps
        key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
        restore-keys: ${{ runner.os }}-mix-
    - name: Install dependencies
      run: mix deps.get
    - name: Check Format
      run: mix format --check-formatted
    - name: Run tests
      run: mix coveralls.json
      env:
        MIX_ENV: test
    - name: Upload to Codecov
      run: |
        curl -Os https://uploader.codecov.io/latest/linux/codecov
        chmod +x codecov
        ./codecov

This configuration will automatically to add coverage results to Codecov. The result will be like this.

Note: The configuration will work for public repository. If you use private repository, please consider modify the configuration. You need to change the line of ./codecov become ./codecov -t ${CODECOV_TOKEN}.

Here is my example app.

Thank you

Thank you for read this article. If have any comments to improve this article, feel free to comment here.

Mock API

We usually ended the solution with Mock API. At least the Front-end team know what is the request object and the response object. Is it will bring json, xml, or files? That’s why we need Mock API. But, yeah, we need the Mock API that no need take long time to build and no need much code to write. We can say that, we need effortless solution. If we still write many codes (I mean, too much effort) just for Mock API, I want to say that, it is useless and better we create the solution directly.

Simple REST API (Mock)

I found a solution that I think it’s good for simple REST API and just need the CRUD (Create, Read, Update and Delete). You can check here.

I am not really sure if that service will reliable, but at least you can use it for short time, and the important things is effortless. But, please take care, since this is public services, make sure you not store any confidential data. You can check the guidance. If you need locally or private solution, you can use Json Server. It is easy to setup. Since the SaaS (Software as a Service), the My JSON Server is public services, I recommend you to setup the Json Server if you really need to be private and have some confidential data (but still not recommend to store this kind of data, better just reasonable dummy data). The disadvantage of this kind Mock API, it’s only support json (when I write this article) for request and response, but good enough if we need the simple REST API.

Postman API

I think this is quite good solution or alternative to create mock API. Please refer this documentation for how to create the Mock API.

I think this is really good solution if you need complex request/response of the API. You can define the collections for request/response, give the description. You can create the documentation also! I want to recommend you to use this features. Somehow, yeah, you can do many things in here.

Happy Exploring!

I just want to say Happy Exploring! I only want to recommend some tools/services that will help you to create the Mock API. So at least you can bring some “contract” to Front-end teams. If you have another solutions or alternatives, feel free to add and comment here.

I just want to say Happy Exploring! I only want to recommend some tools/services that will help you to create the Mock API. So at least you can bring some “contract” to Front-end teams. If you have another solutions or alternatives, feel free to add and comment here.