Allow Key Vault references to access secrets behind Key Vault Firewall
Key Vault references cannot currently be used to access secrets in a vault that has been configured with Key Vault Firewall / service endpoints.
It should be possible to resolve secrets from Vaults configured this way (provided the web app / function app is configured with the right VNET integration).
AdminAzure App Service team
(Product Owner, Microsoft Azure)
shared this idea
This is now available for Windows apps. Linux support is coming soon.
24 comments
-
az_user_21
commented
Please an ETA on this ?
-
Nicols
commented
Hi, What is the ETA on this project? It is surprising that KeyVault on a Vnet does not support the webApp References. This is definitly the "right way" to implement secret look up from a webapp, so please add it ASAP. Thank you.
-
Jonas Sandbekk
commented
Any updates on this? Is it possible to add the inbound IP address to the firewall and use that? Seems to be working, but it's also in the outbound IP list, so unsure if it's actually a solution or something that will come back to bite us.
-
Anonymous
commented
Any idea when this will be available? Whitelisting web app IPs is not acceptable in my organisation
-
Filipe Ines
commented
When we use Vnet Integration in the Azure Functions and a keyVault with firewall enabled for the Azure Function Vnet, the following behaviour happens:
In the azure portal, Azure Function/configuration/application settings, if we try to create a new entry with a reference to a keyvault secret it will give an error, "Key Vault reference was not able to be resolved because site was denied access to Key Vault", on the other way, inside the function code, we can access the keyvault secret using the following statement or similar:
var secretValue = await KeyVault.GetSecret(System.Environment.GetEnvironmentVariable("KeyVaultUrl"), "s30cosmosdbhs1-URL");We would appreciate, that it must be possible to access keyvault, from the configuration of the app setting as it is possible from the code inside a function
-
Carlos Mendible
commented
Any update or ETA on this? This has become a huge road blocker to implement secure solutions in many of my customers with high security requirements (i.e. financial & health)
-
Nathan Manzi
commented
Echoing others here, this is an extremely important requirement for us with a large project to migrate apps into Azure.
-
stephen stroud
commented
Spent a while trying to figure out why the secrets weren't resolving... a needed feature!
-
Pope, Kyle (GE Aviation, US)
commented
We just hit this today too. Last update was almost a year ago, can we please get an update on when this will be planned so we can communicate this to our management?
-
Bartosz Kwiecinski
commented
What is the ETA on this feature. It is really important from our organization.
-
Collis, Matthew
commented
An eta would be great. As others have mentioned, opening up keyvault is not an option for a security conscious company. Also, whitelisting the public function IP should not be necessary with vnet integrated functions....
-
Takekazu Omi
commented
What is the ETA on this?
-
Steven Dian
commented
Would VERY much like this capability added ASAP - lets at least get a preview rolling soon.
-
Anonymous
commented
Andres, great tip and it works :)
-
Andres
commented
For anyone interested, the whitelist approach does work to allow serverless apps to reference keyvault values. In the portal, in your functions app sidebar -> custom domains, grab that IP and whitelist it. Better than disabling the firewall!
-
Oskari
commented
Would it be possible to enlighten us with some estimate. This is a big inconvenience for almost every enterprise environment as we need a ton of boilerplate in our code as internet facing keyvaults are a nono.
-
Anonymous
commented
What is the ETA on this?
-
Arunprasath Senthikumararaj
commented
When it is scheduled to provide this functionality ?
-
Deyan Petrov
commented
Just came across another issue - EventHubTrigger with Connection property pointing to a Configuration Setting which is a Key Vault Reference.
My workaround (resolve explicitly the setting using the Key Vault SDK) does not work here, as there is no way how to dynamically/manually resolve this setting programmatically ... so what should I do here??
Why would anyone ship Key Vault References without consider security - this is beyond my understanding ..
-
Anonymous
commented
Any updates on it?
After a big time investment in moving 20+ functions from Consumption to Premium Plan just to be able to set Vnet Integration now I am hitting this issue :(((