By Ronnie Quan Overview In this blog post, we will continue to explore MS identity platform. External individual user who is not in MS ecosystem and needs to do file collaboration through Azure storage account. Here is the plan for this blog post: Use Azure AD B2C as IDP. Develop SPA…

By Ronnie Quan Overview This bog is a sequel to https://cloudjourney.medium.com/secure-azure-storage-api-16cf87dd39a6 Round 1, develop Angular SPA code, sign in user who is from same organization and call Microsoft Graph API by using the authorization code flow with PKCE Round 2, customize code to call MyStorageApi Round 1 Generate Angular Application Regarding installing latest npm, please refer…

By Ronnie Quan Overview This blog is a sequel to https://cloudjourney.medium.com/azure-storage-aad-authentication-f2eb48e481f. We will secure the MyBlobFile API using MS identity platform, move environment variables to app settings and add more API. This blog’s code is available from https://github.com/Ronnie-personal/identity-for-all/tree/main/SecureApi AAD App Registration What Is App Registration

By Ronnie Quan Overview We will demonstrate .NET SDK code to get authenticated through AAD RBAC and list blob storage containers. Round 1 is console app using access key for authentication Round 2 is console app using AAD RBAC for authentication Round 3 is web api using AAD RBAC for authentication …

By Ronnie Quan Overview We will go over MS sample identity code. Install Node.js and NPM Install nvm For windows, goes to here https://github.com/coreybutler/nvm-windows/releases For Linux, goes to https://github.com/nvm-sh/nvm Install Latest Node To install the LTS (long term support version) or “latest” nvm install latest C:\Users\rquan>nvm install lts Downloading node.js version 16.15.0 (64-bit)... Extracting... Complete

By Ronnie Quan Overview We will utilize sharepoint online to share files with external users, we will focus on verification code (SharePoint One Time Passcode), Microsoft identity platform AAD, AAD B2B integration and MFA to secure access. On Boarding Office 365 We need development environment, let’s sign up o365 developer sandbox subscription, https://developer.microsoft.com/microsoft-365/dev-program. …

By Ronnie Quan Overview We will explore SCP(service control policy) and aws:ResourceOrgID. We will also demonstrate two examples and understand how it eliminates the access to unauthorized resources. Secret Manager Example (credit to https://www.youtube.com/watch?v=951E8zA3Lxc, screenshots from the video) This example demonstrate to ensure principal in your AWS organization can not upload data to AWS…

By Ronnie Quan Overview In this blog post, we will discuss: Why we need AWS S3 fine grain access control What are the available S3 IAM security features to support least privilege and separate duty S3 FGAC in the context of AWS transfer for SFTP Individual Level Data Access We need fine grain access control…

By Ronnie Quan Overview We will explore Route 53 alias records routing to AWS resources and assess fully controlled failover options for Standby takes over primary pattern. Amazon Route 53 alias records provide a Route 53–specific extension to DNS functionality. …