Azure-Functions

A few months ago one of the greatest scandals to hit Azure Functions erupted . . . ASCIIartgate!

#teamAsciiArt became a trending topic on Twitter. Maybe.

The Big Deal

In an effort to reduce the verbosity of logging output by func start in the Azure Functions Core Tools, the decision was made to remove the famed ASCII art. To be fair, running func start did output quite a bit of logs. The ASCII art version of the Azure Functions logo was just one of those logs. It just happened to be the most famous of those logs. The logo was the thing of highly coveted t-shirts!

Earlier this year I wrote a post showing how to set up private site access for Azure Functions. To briefly recap, private site access refers to setting up a virtual network service endpoint to restrict HTTP-based access to the function to be only traffic from the designated virtual network (i.e. inbound HTTP requests). Attempts to access the public endpoint (e.g., https://contoso.azurewebsites.net) result in an HTTP 403 Forbidden message. Service endpoints are great, but they are not without some drawbacks (use a public IP address, doesn’t work with connections from on-premises resources (i.e. ExpressRoute), limited RBAC features, etc.)

As enterprises continue to adopt serverless (and Platform-as-a-Service, or PaaS) solutions, they often need a way to integrate with existing resources on a virtual network. These existing resources could be databases, file storage, message queues or event streams, or REST APIs. In doing so, those interactions need to take place within the virtual network. Until relatively recently, combining serverless/PaaS offerings with traditional network access restrictions was complex, if not nearly impossible.

This post will demonstrate how to create an Azure Function with private site access. Private site access refers to a way for resources within a virtual network to reach out to an Azure Function. Configuring private site access ensures that the specified Azure Function is not able to be triggered via the public internet. Instead, the function can only be accessed via a specific virtual network. The function is private to the specified virtual network.