Azure CDN on custom domain with HTTPS access and SIP parameter in SAS token uses the incorrect IP address

Hi Ganesh,

HTTP is not an option from the security point of view. Where can I submit a feature request or could you forward this post?

Thanks in advance,

Bas

Hello Bas Breijer,

Hope you're having a great day!!

Please share your feedback at the feedback forum:

feedback forum: https://feedback.azure.com/d365community

If you require any further assistance, please do not hesitate to contact us. We are pleased to help you.

Regards,

Ganesh

Hello Bas Breijer,

Follow these steps if something that is in your favor could be helpful.

Approach 1: Private Link

• Block public access to the storage account.
• Create a private link from the Azure Front Door to the storage account.
• Configure the storage account to only be accessible by the Front Door.

Here's the architecture for the private link scenario.

Refer: https://video2.skills-academy.com/en-us/azure/frontdoor/private-link

This approach ensures that the storage account is not exposed to the public internet and can only be accessed through the private link from the Front Door.

Approach 2: SAS Token with IP Restriction and WAF

• Restrict access to the SAS token to specific IP addresses only.
• Configure a Web Application Firewall (WAF) with Azure Front Door to check the IP address of incoming requests.
• If the IP address is valid, the WAF will allow the request to access the storage account using the SAS token.

For further details, please refer to the following link:

Refer: https://video2.skills-academy.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-ip-restriction?tabs=browser

This approach adds an additional layer of security by restricting access to the SAS token based on IP addresses and using the WAF to validate incoming requests.

If the above response helps to address your concern, please remember to "Accept Answer" and "Upvote it" so that others in the community experiencing similar problems can easily find a solution.

Your contribution is greatly appreciated.

Regards,

Ganesh Patapati

Hi Ganesh,

Our goal is to grant (time) limited access to a specific asset for a dynamic IP address via HTTPS om a custom domain. As it became clear from the 4 month running SR, this is currently not possible. The SR contact advised me to post my issue here to get the feature requested, so i did this.

Approach 1 still grants access to all resources, but via a different path.

Approach 2 does not allow dynamic IP address, this solution would work if the clients have a static IP address.

Regards,

Bas