Strengthen cloud security with DevSecOps. Replace shared credentials with Azure RBAC and Managed Identities for safer, traceable access.
Azure RBAC and Managed Identities are important tools that help secure cloud-native architectures. Azure RBAC and Azure Managed Identities are critical tools for securing cloud-native architectures.
This is because, in modern cloud environments, there is a need to manage access securely. Shared credentials with longer lifetimes can introduce greater risk and complexity and make Zero Trust more difficult to maintain.
One solution to these problems is to eliminate shared credentials from container registries and storage proxy networks. The team transitioned to Azure Role-Based Access Control (RBAC), Azure Managed Identities and Microsoft Entra ID.
An Overview
The Problem with Shared Credentials
The old container environment applied static credentials to ACR, AKS and NGINX. This posed security and access-control issues.
ACR Admin Credentials
The ACR Admin User provided one username and two permanent passwords.
The credentials were available, but were not capable of granting permissions to the repository level or read-only access. Additionally, users’ actions were found under the same Admin user, reducing accountability.
Secure Your Cloud Infrastructure.
Secrets in AKS
AKS used imagePullSecrets to access private container images.
This meant that the ACR password was present in Helm files, Git repositories, local settings and cluster backups. This raised the risk of credentials being exposed.
NGINX and Storage Access
NGINX used connection strings, storage keys, or SAS tokens to access Azure Blob Storage.
These credentials continued to be stored in configuration files. Backend storage URLs and parameters could also be revealed in public applications.
The New Identity-Based Approach
The team changed password authentication to an alternative token exchange mechanism on the platform.
Access is now managed by managed identities and Azure RBAC. This will eliminate the requirement for the system components to memorize passwords.
Securing AKS Image Access
The first phase focused on AKS.
The team gave the Kubelet Identity the AcrPull role on the Azure Container Registry. This gave the worker nodes read-only access.
Then,
Engineers deleted the Helm templates and imagePullSecrets.
Now, AKS can ask for a temporary token from the Azure IMDS endpoint and then pull container images.
Securing Storage Access Through NGINX
A System-Assigned Managed Identity was assigned to the NGINX compute tier.
The team gave it the Storage Blob Data Reader role and restricted it to the necessary storage containers.
Then NGINX disables static SAS tokens and connection strings. Rather, it acquires the bearer tokens from Microsoft Entra ID via the Azure IMDS endpoint.
Changing Developer Access
The team also eliminated credentials from the shared local developer workflows.
They turned off the ACR Admin User setting, which made the old static keys invalid. They then granted AcrPush or AcrPull access to Microsoft Entra ID groups based on their roles.
Engineers also removed credentials from Docker’s config.json files and replaced them with short-lived personal session keys via the Azure Command-Line Interface.
Results of the Migration
The new access model improved security and access control across the environment.
| Area | Earlier State | New State |
|---|---|---|
| Secrets | High sprawl | Zero |
| Credential rotation | Manual | Automated |
| Audit trails | Shared Admin identity | User-level attribution |
| Credential lifetime | Long-lived | Short-lived tokens |
| Access control | All-or-nothing | Role-based |
Key Lessons
Use the Kubelet Identity
The main AKS cluster identity cannot give worker nodes registry access. The AcrPull role must be assigned to the Kubelet Identity.
Allow for RBAC Delays
It can take a while for RBAC changes to propagate to the application layers. The team experienced a 2–5 minute delay and updated infrastructure scripts to check access before application startup.
Removing Secrets Simplifies Configuration
The removal of secrets from Helm templates increased portability of configuration and decreased the need for configuration-specific credential-management logic.
Conclusion
The migration replaced shared credentials with an identity-based access model across ACR, AKS, NGINX, Blob Storage, and developer workflows.
The team replaced static secrets with short-lived tokens and enhanced access control and audit visibility by leveraging Azure RBAC, Managed Identities, and Microsoft Entra ID.
