Modify Azure Service Bus Health Check to no require a connection string with management rights
See original GitHub issueWhat would you like to be added:
I noticed that in order for the health check calls AddAzureServiceBusSubscription() and AddAzureServiceBusTopic() to work properly, we need to submit a connection string with management rights. I think it would be preferable if that was not required and if the health check could still be done even if the connection string only had listen or send rights.
Why is this needed: Requiring management rights goes against the principles of least privileges I think and it forces me to decide between the convenience of using the library at the risk of giving more access that I want to my app versus only giving it the access it needs but having to write custom health check for the service bus.
Possible Solutions: For a connection string with listen policy, you could peek on the service bus and see if that works:
private async Task<Message> PeekServiceBusMessage(string connectionString)
{
var connectionStringBuilder = new ServiceBusConnectionStringBuilder(connectionString);
IMessageReceiver receiver = new MessageReceiver(connectionStringBuilder);
return await receiver.PeekAsync();
}
For a send policy, it could be simply sending a dummy message:
try
{
await using (var client = new ServiceBusClient(ServiceBusConnectionString))
{
ServiceBusSender sender = client.CreateSender(topic);
await sender.SendMessageAsync(new object());
}
}
catch(Exception e)
{
//do something
}
There might be more effective solutions, those are just some propositions off the top of my head.
Issue Analytics
- State:
- Created 3 years ago
- Reactions:8
- Comments:19
Top Related StackOverflow Question
This is important. An application should not include a connection string with permissions to delete a queue when it need just to listen/send and check health.
Seems this issue is miss-addressed. Need to contact Microsoft so they can handle that on their side in the Service Bus. The only workaround I found - was the creation of the managed identity with a fine-grained permission set and use it.