Securing a "tiered" application in Azure - azure

Question

Ok.
So I'm new to deploying infrastructure to Azure.
I do understand the basics.
I've been tasked to create a "web tier", "middle tier machine", and "database server" in Azure. I'm probably using on-premise terms for these....maybe they map to Azure.
I am using App-Service-Plan and App-Service. Windows flavored.
I am also liking terraform very much, but this question isn't terraform dependent I think. (terraform is just the fancier way to create the necessary objects in Azure, or that's my novice understanding).
So right now, I've been able to create.
App-Service (which would be my "web-server"). I'll call this AppServiceWT.
App-Service (which would be my "middle tier"). I'll call this AppServiceMT.
And Sql-Server/Sql-Server database.
I've been able to create some of this using terraform flavored scripts.
resource "azurerm_resource_group" "testrg" {}
..
resource "azurerm_app_service_plan" "testaspwt" {
name = "some-app-service-plan-for-webtier"
sku {
tier = "Standard"
size = "S1"
}
}
resource "azurerm_app_service" "testaswt" {
name = "AppServiceWT_SomeGlobalUniqueName"
}
..
resource "azurerm_app_service_plan" "testaspmt" {
name = "some-app-service-plan-for-middletier"
sku {
tier = "Standard"
size = "S1"
}
}
resource "azurerm_app_service" "testasmt" {
name = "AppServiceMT_SomeGlobalUniqueName"
}
..
resource "azurerm_sql_server" "primary_azurerm_sql_server" {}
resource "azurerm_sql_database" "primary_azurerm_sql_database" {}
So I have the "parts" ( I think ??? ).
So my hurdle now is.
What am I doing to secure the network traffic.
Requirements:
The middleTier can make requests sql-server-tier. sql-server-tier is not accessible to anything besides middle-tier. In the on-premise world, we would open up port 1433 on the sql-server to allow traffic.
The webTier can make requests middle-tier. middle-tier is not accessible to anything besides web-tier. In the on-premise world, we would open up port 80/443 on the middle-tier to allow traffic.
WebTier is open to world.
What azure "objects" am I missing?
Bonus points for pointing to terraform "tasks" (or whatever they are called).
https://www.terraform.io/docs/providers/azurerm/index.html
But yeah, I'm reaching out to SOF for help to fill in the "traffic" and "secure network" gaps in my head.
Thanks in Advance.
If I'm asking the wrong questions, let me know.
I do not want to maintain my own VM's. So I think Azure App-Service-Plan and App-Service is the correct choice. While I'm a little familiar with Azure-Functions and Logic-Apps, we want to not use those for this project.
To add a little more info.
I'm eventually trying to do a "hello world" using the below microsoft how-to article. The article above does not have a middle-tier, but once I have the concepts down, I think I can make a web/middle/sql 'hello world'.
https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-dotnetcore-sqldb

Answer 1

There are a few ways you can secure the application in the app service you are creating -
1.I believe you are already doing it or not sure if you require it but
we can authenticate access to the web app (using OAuth2.0 etc..).
2.If you want more control over the network where we are deploying the apps we
can utilize App service Environments which provides
virtual network integration feature that helps you restrict incoming
source IP addresses through network security groups (NSGs).
Probably once can use it for both the front end and middle tier.
3.White-list the allowed ranges of IP Address in the database.In your case if
any other service should not access the database other
than the web app , then it should be the IP of the frontend web app.

Answer 2

With webapps, your only option is opening webapp external ip addresses to sql to be able to talk to each other.
webapp has got several potential external ip addresses it can have, so you open those on sql. traffic will use azure back bone as long as azure sql\webapp are in the same region.
On the middle tier you should use ip restrictions (web.config can do that).