python - Azure function cannot access Keyvault in Azure (Forbidden, not authorized, not trusted), locally works - Stack Overflow

admin管理员组

文章数量:1389864

I have an Azure function fetching secrets from a KeyVault. Both in same resoucegroup, same region. For testing purposes, public access is allowed for whitelisted IPs. Testing locally works with whitelisting my IP address, Azure function can access Keyvault.

Running in Azure does not work, with the following error in function logs:

An error occurred: (Forbidden) Client address is not authorized and caller is not a trusted service. Client address: xx.xxx.xxx.xx

Azure function is configured as follows:

• System assigned identity
• Function object ID added as Key Vault Secrets User (and later even Key Vault Secrets Admin for testing purpose)

Keyvault is configured as follows:

• Access config: Azure RBAC
• Networking: Public access from selected networks, no network security perimeter, whitelisted IP addresses:
  • my local one
  • all IP addresses of the Azure function + all IP addresses in the log error messages
• "Allow trusted Microsoft services to access this resource" is checked

Code snippet

# Use Managed Identity to authenticate
credential = DefaultAzureCredential()

# Create a Key Vault client
client = SecretClient(vault_url=key_vault_url, credential=credential)

# Retrieve mySecret from Key Vault
secret_name = "mySecret"  
retrieved_secret = client.get_secret(secret_name)

I have an Azure function fetching secrets from a KeyVault. Both in same resoucegroup, same region. For testing purposes, public access is allowed for whitelisted IPs. Testing locally works with whitelisting my IP address, Azure function can access Keyvault.

Running in Azure does not work, with the following error in function logs:

An error occurred: (Forbidden) Client address is not authorized and caller is not a trusted service. Client address: xx.xxx.xxx.xx

Azure function is configured as follows:

• System assigned identity
• Function object ID added as Key Vault Secrets User (and later even Key Vault Secrets Admin for testing purpose)

Keyvault is configured as follows:

• Access config: Azure RBAC
• Networking: Public access from selected networks, no network security perimeter, whitelisted IP addresses:
  • my local one
  • all IP addresses of the Azure function + all IP addresses in the log error messages
• "Allow trusted Microsoft services to access this resource" is checked

Code snippet

# Use Managed Identity to authenticate
credential = DefaultAzureCredential()

# Create a Key Vault client
client = SecretClient(vault_url=key_vault_url, credential=credential)

# Retrieve mySecret from Key Vault
secret_name = "mySecret"  
retrieved_secret = client.get_secret(secret_name)

• python
• azure-functions
• azure-keyvault

Share Improve this question Follow edited Mar 13 at 10:56 ray asked Mar 13 at 7:16 rayray 17111 gold badge44 silver badges2121 bronze badges 8

• 1 Enable Allow trusted Microsoft services to access this resource in Key Vault’s Networking settings. – Dasari Kamali Commented Mar 13 at 9:13
• What are the roles you have assigned to the Function app in Key Vault? – Dasari Kamali Commented Mar 13 at 9:57
• @DasariKamali sorry I fot to mention, "allow trusted services" is checked, I edit my post. And the roles I already listed, I tried both Key Vault Secrets User and Admin – ray Commented Mar 13 at 10:55
• Have you added the function app's IP address to the Key Vault as mentioned in the error? – Dasari Kamali Commented Mar 13 at 11:03
• Yeah and I also wrote this in my post und "whitelisted IP addressses" – ray Commented Mar 13 at 12:39

 |  Show 3 more comments

1 Answer 1

Sorted by: Reset to default 0

If anyone runs into the same problem:

The only solution I found was by switching to Azure Flexible Consumption plan to allow for vnet integration and then using a vnet / service endpoint to let the Azure Function access KeyVault secrets.

本文标签：