We are using Microsoft Azure App Services to host some of our Web Apps.
Web Apps connect to on-premises SQL Server over hybrid connections.
When new Web App needs access to the on-prem SQL Server, a dedicated SQL login is created, and the connection string (with password, etc.) is sent to the developer responsible for that app. Developer then goes to Web App -> Configuration and pastes the connection string into corresponding section, so the application could use it.
The problem with this approach is that some other developers have Contributor access in a subscription, and they can see those connection string, and subsequently they can see the SQL Server login and password.
Those SQL accounts can have elevated permissions on tables, which are normally not supposed for Developers to have, but as we can see SQL Serverpasswords are exposed, so these can be abused.
Is there a way to put connection string "somewhere else" - not in Configuration pane of the Web App, but in some other location where application can use it, but developer (even if dev is a Contributor) can not?
Is there a way for an Azure Web App to use
Integrated Security=TRUEand login to SQL Server using some domain account, so developers don't see its password in connection strings?
Any other options? I know it is also policy thing, but right now it is what it is, and I can't say Developers are doing some abuse, no, but still would like to implement some secure solution.