Azure IMDS：防火墙规则仅授予本地系统管理员访问权限以获取托管标识令牌

Question

We have our application running on an Azure VM. this application has three windows services that queries a sql managed instance using a user-managed identity. These services run as local system account.

Now, we want to make sure that only these services which are part of our application can query the sql managed instance and other applications running on that VM should not have access to the sql managed instance. I found that we need to create fire wall rules for the Azure IMDS. I want to know how to create firewall rule that only provides access to local system account to query the IMDS?

Answer 1

The exact details will vary depending on the firewall you are using, but in general yes you can use the in guest firewall to restrict access to IMDS. In fact, there is another service using the IP 168.63.129.16 that by default in Azure images is only accessible by admin processes via a firewall restriction.

I'm not familiar with authoring Windows firewall rules, but I would suggest looking them up broadly ("Restrict IP access to admin only" or something to that effect) or trying to copy whatever the rule looks like for that other Azure service.

A couple things to note as you go through this process:

1. Firewalls are an extremely fragile way to gate access to this resource. It can be done but it's also very easy to mess up. Exploits have been found in workloads that don't do it properly. You have to consider all lifecycle chains as the access defaults to open, and it's easy to unintentionally bypass the firewall in workloads such as nested virtualization. If this is all defense in depth, it's less of an issue. If you're aiming to run untrusted code in your VM, you need to be extremely careful and do threat modeling to have any degree of confidence in this solution.
2. The IMDS IP routing is "magic" since it's an unrouteable IP address. You are trying to change access to a rule that Azure will attempt to manage for you at provision time, so you can run into conflicts. If you mess up the rule, IMDS will become entirely inaccessible. Consider adding an additional, more restrictive rule rather than trying to edit the one Azure creates for you.

In summary, you can do this. There are many things hosted on Azure that do, but there are many pitfalls both in terms of security and availability. Just make sure you're treating it with due diligence.