Skip to content

Use a least-privilege SQL identity for the app #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-agentic-autofix wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Use a least-privilege SQL identity for the app #73

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
019a0ef
Initial plan
Nov 12, 2026
e953c98
Use least-privilege SQL app credentials
Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,17 @@ The web server and SQL database are the minimum requirements for this app to wor

You can use this link to deploy all resources automatically in your Azure subscription [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fmageroni%2Fcopilot-survey-engine%2Fmain%2Fdeployment%2Ftemplate.json)

For deployments using `deployment/template.bicep`, configure the app's SQL credentials separately from the SQL server administrator credentials. Before starting the app, create a contained database user named `copilotSurveyApp` in the `copilotUsage` database using the password supplied as `sqlApplicationLoginPassword`. Grant that user only the permissions needed by the app:

```sql
CREATE USER [copilotSurveyApp] WITH PASSWORD = '<application-password>';
GRANT CREATE TABLE TO [copilotSurveyApp];
GRANT ALTER ON SCHEMA::dbo TO [copilotSurveyApp];
GRANT SELECT, INSERT, UPDATE ON SCHEMA::dbo TO [copilotSurveyApp];
```

The app creates `SurveyResults` on first use and then reads and writes survey responses. Do not use the SQL server administrator credentials for the app connection.

### Step 2. Execute locally and configure secrets

To run the application on you local machine you'll need to have installed NodeJS. Once you have it, you can access to the folder where you've cloned this project and run the following:
Expand Down
6 changes: 5 additions & 1 deletion deployment/template.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ param sqlAdministratorLogin string
@secure()
param sqlAdministratorLoginPassword string

@description('Password for the application-specific Azure SQL database user')
@secure()
param sqlApplicationLoginPassword string

@description('application insights name')
param appInsightsName string

Expand Down Expand Up @@ -310,7 +314,7 @@ resource appService 'Microsoft.Web/sites@2022-09-01' = {
}
{
name: 'DATABASE_CONNECTION_STRING'
value: 'Server=tcp:${sqlServer.name}${environment().suffixes.sqlServerHostname},1433;Initial Catalog=copilotUsage;Persist Security Info=False;User ID=${sqlAdministratorLogin};Password=${sqlAdministratorLoginPassword};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;'
value: 'Server=tcp:${sqlServer.name}${environment().suffixes.sqlServerHostname},1433;Initial Catalog=copilotUsage;Persist Security Info=False;User ID=copilotSurveyApp;Password=${sqlApplicationLoginPassword};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;'
}
{
name: 'LANGUAGE_API_ENDPOINT'
Expand Down
Loading