Can we deny Admin API method calls with API policies?

Question

question

Francois Boucher-Genesse asked Sep 18, '20

Can we deny Admin API method calls with API policies?

We're implementing the password recovery flow with a custom page on our website to change the password. We're using the Admin API ResetPassword to do this.

We're taking measures to secure the secret key on our website without it being visible in the browser client, but to be extra safe we would like to limit possible calls to other Admin methods we're not currently using.

We've been able to update the Client API policy using the Admin API UpdatePolicy. But so far we've had no luck restricting calls to the Admin API, testing with the ResetPassword method.

My current understanding is that the following policy should allow all Client/Server methods and restrict every Admin API method but GetPolicy and UpdatePolicy (in order to not lock us out of changing that policy down the road). Is the policy wrong, or is it just impossible to deny admin methods?

    [
        {
            "Resource": "pfrn:api--/Client/*",
            "Action": "*",
            "Effect": "Allow",
            "Principal": "*",
            "Comment": "The default allow all statement."
        },
        {
            "Resource": "pfrn:api--/Server/*",
            "Action": "*",
            "Effect": "Allow",
            "Principal": "*",
            "Comment": "The default allow all statement."
        },
        {
            "Resource": "pfrn:api--/Admin/UpdatePolicy",
            "Action": "*",
            "Effect": "Allow",
            "Principal": "*",
            "Comment": "Preserve our ability to call UpdatePolicy"
        },
        {
            "Resource": "pfrn:api--/Admin/GetPolicy",
            "Action": "*",
            "Effect": "Allow",
            "Principal": "*",
            "Comment": "Preserve our ability to call GetPolicy"
        }
    ]

apis

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2020-09-18T08:16:19Z

Sarah Zhang answered Sep 18, '20

PlayFab API policy doesn’t support denying Admin API methods. You can use the following statement to deny all Client API calls.

[
        {
            "Resource": "pfrn:api--*",
            "Action": "*",
            "Effect": "Deny",
            "Principal": "*",
            "Comment": "…"
        }
]

For your situation, we would suggest you use a secret key that can be disabled. Please check this documentation -- https://docs.microsoft.com/en-us/gaming/playfab/gamemanager/secret-key-management to learn more about secret key management.

1

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Francois Boucher-Genesse commented · Sep 21, 2020 at 06:08 AM

Understood, we will indeed use another secret key for this in case it gets compromised. Thanks for the quick answer Sarah.

0 ·

question