Securing .NET Microservices on AWS with Microsoft Entra ID

aws secretsmanager create-secret \
    --name "fintech/transaction-processor/identity" \
    --secret-string '{"ClientId":"","ClientSecret":"","TenantId":""}'

using System.Text.Json;

public class TokenAcquisitionService
{
    private readonly IConfiguration _config;
    private readonly HttpClient _http;
    private string? _cachedToken;
    private DateTime _expiry = DateTime.MinValue;

    public TokenAcquisitionService(IConfiguration config, HttpClient http)
    {
        _config = config;
        _http = http;
    }

    public async Task GetTokenAsync()
    {
        // 1. Check Cache (with 5 min buffer)
        if (!string.IsNullOrEmpty(_cachedToken) && DateTime.UtcNow < _expiry.AddMinutes(-5))
        {
            return _cachedToken;
        }

        // 2. Prepare Request
        var tenantId = _config["AzureAd:TenantId"];
        var tokenUrl = $"https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token";
        
        var request = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair("client_id", _config["AzureAd:ClientId"]),
            new KeyValuePair("client_secret", _config["AzureAd:ClientSecret"]),
            new KeyValuePair("scope", _config["FraudDetector:Scope"]),
            new KeyValuePair("grant_type", "client_credentials")
        });

        // 3. Execute
        var response = await _http.PostAsync(tokenUrl, request);
        response.EnsureSuccessStatusCode();
        
        var json = await response.Content.ReadAsStringAsync();
        var data = JsonSerializer.Deserialize(json);
        
        _cachedToken = data.GetProperty("access_token").GetString();
        _expiry = DateTime.UtcNow.AddSeconds(data.GetProperty("expires_in").GetInt32());

        return _cachedToken!;
    }
}

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Identity.Web;

var builder = WebApplication.CreateBuilder(args);

// Add Microsoft Identity Web (simplifies Entra ID auth)
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddControllers();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

[Authorize]
[ApiController]
[Route("[controller]")]
public class FraudController : ControllerBase
{
    [HttpPost("analyze")]
    public IActionResult AnalyzeTransaction([FromBody] Transaction t)
    {
        // Only accessible with a valid Bearer token
        return Ok(new { RiskScore = 0.05, Status = "Approved" });
    }
}