L14. Securing Containers and Application Platform Services: AKS, Container Registry & App Service

Defender for Containers

Defender for Containers protects containerized workloads across their full lifecycle:

• Registry scanning: scans container images for known vulnerabilities as they're pushed to Azure Container Registry, and can gate CI/CD pipelines from deploying images with critical findings
• Runtime threat detection: monitors AKS clusters for suspicious behavior at runtime (unexpected process execution, container escape attempts, connections to known malicious IPs)
• Kubernetes data plane hardening recommendations: surfaces misconfigurations against Kubernetes security best practices (like overly permissive pod security contexts) as actionable recommendations
• Agentless discovery for Kubernetes: inventories cluster workloads and configuration without requiring an in-cluster agent, complementing the in-cluster sensor used for deeper runtime detection

AKS Security Controls

• Azure RBAC for Kubernetes authorization: lets you manage Kubernetes-level permissions (what a user can do *inside* the cluster, like create pods or read secrets) using the same Azure role assignment system as everything else, instead of maintaining a completely separate Kubernetes RBAC configuration
• Network policies: control pod-to-pod traffic within the cluster, the Kubernetes-native equivalent of an NSG scoped to the pod network layer
• Private clusters: the AKS API server gets a private endpoint instead of a public IP, so cluster management traffic never traverses the public internet
• Workload Identity: lets pods authenticate to Azure resources (Key Vault, storage) using a federated Microsoft Entra identity tied to a Kubernetes service account, avoiding stored credentials inside the cluster, the AKS-native equivalent of a VM's managed identity

Azure Container Registry Security

• Content trust: enforces that only signed images can be pulled, preventing an unsigned or tampered image from being deployed
• Private endpoints: remove the registry's public endpoint, matching the same private-link pattern used elsewhere
• Vulnerability scanning: (via Defender for Containers registry scanning, above) inspects every pushed image layer for known CVEs

Container Instances and Container Apps

• Managed identity: both services support system- and user-assigned managed identities, the same pattern as VMs and Functions, for credential-free access to other Azure resources
• VNet integration: places the container's network interface inside your VNet, enabling private connectivity and NSG-based traffic control instead of relying purely on public ingress
• Ingress restrictions (Container Apps): can restrict ingress to internal-only (VNet-reachable) or require specific authentication before traffic reaches the app

Azure Functions Security

• Authentication (Easy Auth): built-in authentication that validates tokens (Entra ID or other providers) before a request ever reaches function code, without writing auth logic into the function itself
• Network access controls: private endpoints and VNet integration restrict both inbound access to the function and outbound calls the function makes to other resources

Azure Logic Apps Security

• Managed identity: connectors can authenticate to other services using the Logic App's own managed identity instead of stored credentials
• IP restrictions: limit which networks can trigger an HTTP-triggered Logic App
• Secure parameters and connections: sensitive inputs (like a connection string) can be marked secure so they're excluded from run history logs, preventing accidental credential exposure in the workflow's execution trace

Azure App Service Security

• Authentication/authorization (Easy Auth), managed identity, private endpoints, IP restrictions, and enforced minimum TLS version together form the same layered pattern seen across every platform service in this lesson: identity-based access to the app, credential-free access from the app, and network-level exposure control.

Azure Web Application Firewall

Azure WAF protects web-facing applications (behind Application Gateway, Front Door, or CDN) using the OWASP Core Rule Set for common attack patterns (SQL injection, XSS), plus custom rules for application-specific logic and bot protection to filter malicious automated traffic before it reaches the application.

API Management Security Policies

API Management protects back-end APIs through policies applied at the gateway: subscription key requirements, OAuth token validation before forwarding a request to the backend, IP filtering, and rate limiting, so the backend API itself never has to implement these controls directly, and every API behind the gateway inherits the same consistent policy enforcement. Exam tip: Every service in this lesson repeats the same three security levers (identity for access, managed identity for outbound calls, network controls for exposure), recognizing that pattern is more valuable for the exam than memorizing each service's setting names individually.