There are various scenarios where Azure Functions can be utilized; there is a possibility for integrating them with Azure components. However, security measures should be taken during this process to ensure that the credentials are not hacked and stored in the right place. Therefore, Azure Key Vault is necessary to enhance data protection and compliance, boost performance and reduce the latency of the cloud applications.

In this blog post, we will unveil some techniques to integrate Azure Key Vault with Azure Function App in detail.

TABLE OF CONTENT

1. Function App Creation

2. Azure Key Vault Creation

3. Providing Permissions to Function Apps

4. Accessing All Secrets from Vault using Function App by HTTP Trigger

5. Conclusion

6. About CloudThat

1. Function App creation

Open the Azure portal, search for Function APP in the search bar, and click on the create button.

Select your subscription and create a resource group (if not exist) and fill in the remaining details as below.

Leave the remaining fields as default and click on the Review + create button and click the create button.

2. Azure Key Vault creation

Open the search bar, search for Key Vault, and click on the create button.

Fill in the details of Subscription, Resource Group, Vault Name, Region and leave the remaining fields as default and click on the Review + Create button so that it will validate your deployment details. Once your validation is successful, then click on Create button, it will start your deployment.

3. Providing Permission to Function App

Go to your Function App that you have created earlier; if you scroll down in the left pane, you can see an option called Identity click on it.

You can see an option System Identity; by default, the status of System Identity will be Off, so turn the status to On. Now Object ID will be generated to the Function App, copy the Object ID and go to the Key Vault you have created before.

Click on Access Policies and Add Access Policies.

Fill in the details as mentioned below and ensure that key permissions contain GET, LIST permissions. Click on Select Principle, paste the Object ID of Function APP, select your Function App, and click on the Add button.

Now your Function has enough permissions to read all secrets from the Key Vault. We will create some secrets and try to fetch them using the Function APP.

Click on Secrets Pane that can be visible in the left pane of the vault home page. Next, click on Generate/Import button on top and provide the Name and values of your secret and click on create button. Now your secrets are encrypted and stored.

4. Accessing all secrets from Vault using Function App by HTTP trigger

import azure.functions as func
import logging
import os
from azure.identity import ManagedIdentityCredential
from azure.keyvault.secrets import SecretClient

def main(req: func.HttpRequest) -> func.HttpResponse:
    logging.info('Python HTTP trigger function processed a request.')

    
    identity = ManagedIdentityCredential()
    secretClient = SecretClient(vault_url="https://vaulttest888.vault.azure.net/", credential=identity)
    #return func.HttpResponse(f"Hello, the Secret key value for {SecretName} is {secret.value}")
    secret_properties = secretClient.list_properties_of_secrets()
    Secret_list={}
    for secret_property in secret_properties:
        secret_property.name
        secret = secretClient.get_secret(secret_property.name)
        Secret_list[secret_property.name]=secret.value
    return func.HttpResponse(f"{Secret_list}")

import azure.functions as func

import logging

import os

from azure.identity import ManagedIdentityCredential

from azure.keyvault.secrets import SecretClient

def main(req: func.HttpRequest) -> func.HttpResponse:

logging.info('Python HTTP trigger function processed a request.')

identity = ManagedIdentityCredential()

secretClient = SecretClient(vault_url="https://vaulttest888.vault.azure.net/", credential=identity)

#return func.HttpResponse(f"Hello, the Secret key value for {SecretName} is {secret.value}")

secret_properties = secretClient.list_properties_of_secrets()

Secret_list={}

for secret_property in secret_properties:

secret_property.name

secret = secretClient.get_secret(secret_property.name)

Secret_list[secret_property.name]=secret.value

return func.HttpResponse(f"{Secret_list}")

The code mentioned above will fetch all the secrets and secret values in the form of key-value pair and in the twelfth line please make sure that you can replace the URL with your Vault URL available at your vault home page.

If you run the above code, it will fetch all the secrets of your Vault in the form of key-value pair.

5. Conclusion

A secret can be anything from API keys, passwords, security certificates, or cryptographic keys. In the digital era, password loss and security certificate expiration can have a significant impact on business. Azure Key Vault is a cloud service for securely story credentials and accessing secrets. Learn more about Azure Key Vault and other Microsoft Azure services on this site. If you have any queries about Azure Key Vault or Azure Function Apps, drop a message in the below comment section, and I will get back to you quickly.

6. About CloudThat

CloudThat provides end-to-end support with all the Azure services. CloudThat being the Microsoft Gold Partner and pioneer in Cloud training and Consulting in India since 2012 is the right ally for you. We are on a mission to build a robust cloud computing ecosystem by disseminating knowledge on technological intricacies within the cloud space. Read more about CloudThat’s Consulting and Expert Advisory.