How can we improve Microsoft Azure Functions?

← Azure Functions

Add binding to Key Vault

Functions often need password, API keys, and connection strings to connect to other services and retrieve data. It would be great if those secrets could easily be obtained from Key Vault.

398 votes
Sign in
(thinking…)
Sign in with: Microsoft
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close

We’ll send you updates on this idea

Anonymous shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →
completed  ·  AdminAzure App Service team (Product Owner, Microsoft Azure) responded  · 

Hi all,

Thank you all for the comments and feedback. We’re very pleased to announce that support for Key Vault references is now generally available! You can find the update here: https://azure.microsoft.com/updates/general-availability-of-key-vault-references-in-app-service-and-azure-functions/

The work certainly doesn’t stop here. We are looking to add support for additional networking configurations, and work is underway for rotation handling (making the version string optional). Please consider putting votes towards these features as well! They are captured below.

Rotation: https://feedback.azure.com/forums/169385/suggestions/36532414

Firewall/ServiceEndpoints: https://feedback.azure.com/forums/355860/suggestions/38817385

Again, thanks for all of the input on this item. It really does make a difference.

- Matthew

Show previous admin responses (3)

51 comments

Sign in
(thinking…)
Sign in with: Microsoft
Forgot password?
Create a password
Signed in as (Sign out)
Close
Close
Submitting...
An error occurred while saving the comment
  • Daniel commented  ·   ·  Flag as inappropriate

    Can we also not specify the version for the secret? One of the big perks of the key vault is the ability to update a secret without making any other changes.

  • Srikanth commented  ·   ·  Flag as inappropriate

    It's been more than 6 months now.. Is it still in public preview? This is some thing that can not really wait so long :)

  • Mahesh Nagaiah commented  ·   ·  Flag as inappropriate

    We are looking forward for the General availability dates of this feature. Can you please share the same?

  • Brett Caswell commented  ·   ·  Flag as inappropriate

    is the KeyVaultSample in the github source of Microsoft.Extensions.Configuration package a suitable workaround for this?

    https://www.nuget.org/packages/Microsoft.Extensions.Configuration/

    also,
    Is your recommendation to still use EnvironmentVariables (as stated in the last paragraph here: https://docs.microsoft.com/en-us/azure/azure-functions/functions-dotnet-class-library#environment-variables )

  • Vinny commented  ·   ·  Flag as inappropriate

    Any news on this feature ? We're using Azure Functions v2 with MSI and accessing secrets within the function works. However, now I require those secrets to also be accessible in the trigger bindings for eventhub and servicebus connections due to security reasons. When can we expect this feature?

  • Anonymous commented  ·   ·  Flag as inappropriate

    Any updates on this. We are using EventHubTrigger in Azure Functions, but it requires binding connection string into local.settings.json whereas we have all our applications migrated to KeyVault secrets. We would like to follow the same approach with Azure Functions but it doesn't seem supported for now. Can you please provide this feature as soon as possible, as already Azure Functions 2.0 (~beta) is already out and in use.

  • Jacque de Kock commented  ·   ·  Flag as inappropriate

    Very high in demand. We often have to over complicate infrastructure to achieve this function. Cannot wait for it to be available.

  • srinivasu commented  ·   ·  Flag as inappropriate

    Please support at the earliest (MSI enabled function and secret Uri in trigger binding)

  • Steve Haeney commented  ·   ·  Flag as inappropriate

    Just to echo what many are saying. Without KeyVault access directly in the bindings, you're unlikely to be able to use Azure Functions with Queues/Topics in the Enterprise.

    Storing the connection string in plain text in the configuration is a no-go

  • Vivek Desai commented  ·   ·  Flag as inappropriate

    Upvoting this request. from the Aug 2016 reply it seems this is being interpreted as a request to add Keyvault as a new binding ("when we’re ready to start adding more bindings"). What is really required to to have existing bindings resolve secrets from a Keyvault configuration source rather than looking to resolve them from json or env variables only.

    The Keyvault + Managed Service Identity is an excellent combination, but without the ability of bindings like cosmosdb, storage table etc to retrieve connection strings from key vault source, it is becoming impossible to use Key vault and MSI for Azure Functions.

  • Tom Castiglia commented  ·   ·  Flag as inappropriate

    Wow, surprised to see this is not supported yet. Hope the Azure App Service Team can respond soon with an update/ETA.

← Previous 1 3

Azure Functions

Categories

Feedback and Knowledge Base

(thinking…)
Hosted by UserVoice