As DevOps move toward no-code apps in the cloud, there becomes a need for security reviews and controls to prevent risky
This is nothing new, but the need for better security reviews is becoming clear as more people try to rush to get their apps done in the easiest way possible.
Here’s a simple approach to identifying security risks in your logic apps:
- Create an architecture diagram of your logic app. This can be a simplified version that just shows the high level logic.
- Break down the logic app by it’s components:
- The individual logic app components – you likely won’t find too many security problems here.
- all the parameters – don’t hardcode passwords into parameters!
- connectors – Often the culprit of weak security in logic apps. Really understand what these connectors are communicating with. Don’t allow public access. Limit the roles/permissions.
- app registrations – another culprit of weak security. If app registrations are needed for your logic apps, be sure permissions are set to their most restrictive settings. avoid read.all readwrite.all settings.
- managed identities – if possible, use managed identities instead of user accounts for your connectors. Many logic apps don’t yet support managed identities, so those apps will require additional monitor and possibly frequent password/secret changes.
3. Use Resource Locks to prevent changes. If someone tries to turn off resource logs be sure it’s logged and alerted on.
4. Restrict user/admin access to your logic apps. Some apps can have really powerful permissions/access, so you don’t want users to ever have the ability to change logic apps unless they’ve been given specific short-term permissions to do so.
5. LOG EVERYTHING – wherever possible, enable logging within logic apps and connectors. Store logs in a Log Analytics Workspace. Use Azure Monitor alerts ore Microsoft Sentinel to monitor/report/alert on all activities.
6. Perform ‘attack simulations‘. Run your logic apps through test conditions which will trigger your alerts. Validate your alerts work as expected.
7. Build a ‘logic app security audit’ spreadsheet. Use this as a template for repeated audits for future logic app security testing. Use the above ideas as the initial framework for your spreadsheet.
Simple-Security 