Understanding RBAC While Building SimulAite's AI Infrastructure

 

A few days ago, my dad and I were working out how SimulAite’s servers should securely connect to our Microsoft Foundry infrastructure.

The simplest option was familiar:

Endpoint URL + API key.

But that key would effectively become the entire security model. Anyone who obtained it could potentially make the same requests as our application. That discussion introduced me to a much stronger approach: identity-based authentication using RBAC - Role-Based Access Control. It answers three questions:

Who are you?
What are you allowed to do?
Where are you allowed to do it?

In Azure, this means assigning a particular role to a particular identity at a particular scope. Instead of handing one powerful secret to everything, each part of the system receives only the access it actually needs.

I discovered that applications can have identities too.  Azure can assign a managed identity directly to a service running our API. That service can then request an authentication token and use its verified identity to access another Azure resource - without us storing a permanent secret in the code.

Suddenly, our different environments could be treated like different actors:

  • development could have the permissions needed for experimentation;
  • staging could access only the resources required for testing;
  • production could receive a tightly restricted set of permissions.

Azure would not merely know that a request contained the right key. It could know which environment made the request and exactly what that environment was authorised to do.

Then I discovered DefaultAzureCredential, which makes the design even cleaner. The same application code can authenticate differently depending on where it runs. On my laptop, it can use my Azure CLI or development login. Once deployed to Azure, it can use the server’s managed identity instead.

The code stays the same. The identity changes with the environment. So Elegant :)

I love how building SimulAite continually leads us into ideas like this. We begin by solving one immediate engineering problem like “How should our server call an AI model securely?” and somehow end up discovering an entire principle behind modern cloud infrastructure and security.


Popular Posts