Skip to main content

Creating a Role for Azure Front Door

You can add your Azure Front Door to IO River and use it with your services.
To use Azure Front Door, you need to set up the following:

  • A Key Vault that stores your TLS certificates
  • A user-assigned managed identity, granted access to that Key Vault, which Front Door uses to read certificates
  • A Role assignment that provides IO River access to Front Door

You can follow the steps described below, or download this script to perform the setup automatically.

Step 1 – Creating a Key Vault​

If you already have a Key Vault instance, you can use it with IO River and skip this step.

  1. Navigate to Key Vaults in the Azure Portal.
  2. Click Create, and select the relevant Subscription and Resource Group.

Step 2 – Creating a User-Assigned Managed Identity for Front Door​

Azure Front Door needs a managed identity to read your certificates from the Key Vault. IO River attaches this identity to every Front Door profile it creates on your behalf, so it only needs to be created and granted access once.

  1. Navigate to Managed Identities in the Azure Portal.
  2. Click Create, and select the relevant Subscription and Resource Group (the same resource group you'll use for Front Door).
  3. Give it a name, e.g. ioriver-frontdoor-identity, and click Create.

Or, using the CLI:

az identity create --name ioriver-frontdoor-identity --resource-group <resource-group>

Once created, grant this identity access to your Key Vault:

  1. Navigate to the Key Vault and select Access control (IAM).
  2. Select the Role assignments tab.
  3. Click Add and select Add role assignment.
  4. In the list of roles, select Key Vault Secrets User, then click Next.
  5. Under Assign access to, select Managed identity, click Select members, and search for the identity you created (e.g. ioriver-frontdoor-identity).
  6. Click Next to complete the role assignment.

Finally, note the identity's name — you'll need to provide it to IO River along with your other Azure account details.

Step 3 – Creating a Role for IO River​

Follow the steps below to create the role for IO River:

  1. Navigate to the relevant Resource Group in your Azure account.

  2. Select Access control (IAM) from the sidebar.

  3. Open the Role assignments tab.

  4. Create a custom role:

    • Click Add and then Add custom role.
    • Select Start from JSON.
    • Use this JSON file.
      Before using the file, replace the subscription ID and resource group placeholders with your own values.
    • Complete the wizard to finish creating the role.

  5. Create a role assignment:

    • Click Add and then Add role assignment.
    • Search for the role created in the previous step (e.g., ioriver-role), then click Next.
    • Click Select members, search for ioriver-platform, and select the application.
    • Click Next to complete the role assignment.

Once completed, you can provide your Azure account details as shown in the example below.

Example of Azure Front Door Credentials​

tenant_id = "d201248a-c2e9-402e-8281-a5d3eefd8d3d"
subscription_id = 'e986b596-dbc9-cf41-8666-985b32e6bf71'
resource_group = "staging"
identity_name = "ioriver-frontdoor-identity"