"Key vault reference error" in azure web app configuration setting

Question

I have a private certificate that was generated by azure for a web app for linux containers. I want to pass this value to my .net core app via the web app configuration settings in the the azure portal. This is part of a pipeline CI-CD process and the ability to specify Identity Server key values in app configuration helps to keep those values out of the source code.

PROBLEM

I keep getting the following error by the setting

❌Key vault Reference

also shown here:

I am trying to use the secret value in the format suggested by the microsoft docs here I have tried the following formats:

@Microsoft.KeyVault(https://myvault.vault.azure.net/secrets/myCertName/versionGUID)

@Microsoft.KeyVault(VaultName=myvault;SecretName=myCertName;SecretVersion=versionGUID)

ALSO, I have added the web app to the access policies of the azure key vault

EDIT 1:

There was a format error and I had the wrong secret name so the following format worked:

@Microsoft.KeyVault(https://myvault.vault.azure.net/secrets/myCertName/versionGUID)

However I ran into a new error:

Key Vault reference was not able to be resolved because site Managed Identity not enabled MSINotEnabled

SO I went to the identity tab of the web app and turned on managed identity for the app.

I am now stuck with the following error:

Key Vault reference was not able to be resolved because site was denied access to Key Vault reference's vault.

I found multiple sites that said if you just deleted the setting, saved, and then add the setting back it should resolve. This DID NOT work for me.

I also tried granting "Full access" to the web app in the azure key vault access policies.

score 24 · Accepted Answer · answered Sep 24 '20 at 01:52

24

Firstly, the reference format @Microsoft.KeyVault(https://myvault.vault.azure.net/secrets/myCertName/versionGUID) is wrong, it should be @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/myCertName/versionGUID).

Secondly, I don't think you granted the permission for the MSI of your web app correctly.

From the description in your original post:

ALSO, I have added the web app to the access policies of the azure key vault

Then in your EDIT 1:

SO I went to the identity tab of the web app and turned on managed identity for the app.

Obviously the order is wrong, if you didn't enable the MSI of the app before, how you add it to the access policy? I suppose you may added the wrong one.

So in your case, make sure you have added the MSI of the web app to the access policy correctly.

1.Navigate to the web app -> Identity -> copy the Object ID(also make sure you are using system-assigned MSI, the user-assigned MSI is not supported in keyvault reference feature)

2.Then in the Access policies of the keyvault -> Add Access Policy -> seacrh for the Object ID in step 1 and add it with the Get Secret permission like below -> select and save.

3.Navigate to the app and check it, it works fine.

answered Sep 24 '20 at 01:52

Joy Wang

39,905
3
30
54

1

thanks, you are right, I fixed the format error and then I had to delete the access policy and re add it after enabling MSI. – J King Sep 24 '20 at 14:24
Just FYi, if your enterprise established role-based access control be careful with messing with the access policy as it can "break the key vault". – DataBach Mar 04 '22 at 11:28
Hey thanks for your very detailed response! Just wanted to add that I just ran into this issue (and fixed it) but it looks like in 2022, you still CANNOT use user assigned MSI for this (which kinda sucks) – Farid Hajnal Jun 15 '22 at 16:41
1

@FaridHajnal You can use user assigned MSI's since 2021 https://github.com/Azure/Azure-Functions/issues/1795#issuecomment-888173437 You need to do an extra step to make it happen: https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli#access-vaults-with-a-user-assigned-identity – Douglas Young Mar 12 '23 at 20:49
I had the same problem, doing the above was needed, however did not fix the issue. I still got the same errors. I also needed to select App Service > Specific App Service Slot > Network > Vnet > create new vnet. As our network was sending it out to the public by default, needed to create a vnet so all communication could route internally for calls to the key vault. – Dave Aug 03 '23 at 16:49

score 5 · Answer 2 · edited Mar 23 '21 at 17:26

5

Your app should be able to reach the Key Vault to resolve a reference successfully. If everything else, e.g., access policies and syntax, appears to be in order and yet your references don't resolve, try checking if your Key Vault has any network restriction.

If you see the warning related to the 'network access control' on your Vault's Access policies settings page, you need to allow your app's IP through the Key Vault firewall.

Add your app’s IP (available under Custom domains) to your Key Vault’s firewall (under Networking).

Reference: https://medium.com/geekculture/troubleshooting-azure-key-vault-references-in-azure-function-apps-b228c1216f63

edited Mar 23 '21 at 17:26

Dharman

30,962
25
85
135

answered Mar 23 '21 at 17:20

Dhyan

66
1
4

Hey @Dharman, I'm new around here. May I ask the purpose of editing my answer? Here's the guide from StackOverflow: https://stackoverflow.com/help/editing And I don't see any need for any edits in my answer. – Dhyan Mar 23 '21 at 21:01
When posting answers on Stack Overflow we try to keep all the noise to the minimum. This is to respect the time of people who read these answers. "Hope it helps" adds nothing to the solution and is only a visual nice. We also do not put our signatures, greetings, or personal background story. Just stick to the solution and nothing else. Thank you for being considerate and respecting readers time. – Dharman Mar 23 '21 at 21:04
1

@Dhyan I know this is a post is old, but I just found this post after days of researching the issue. Your response helped me solve my problem. Thank you! – Tim Jun 17 '22 at 19:18
1

There is an option called "Allow trusted Microsoft services to bypass this firewall" in the Exception section to automatically do this for known IP addresses for Azure. But sometimes this setting doesn't apply right away. – Shehan Weerasooriya May 12 '23 at 08:28

score 2 · Answer 3 · answered Nov 04 '22 at 05:46

2

If it is a User-Managed Identity, we need to do a patch to make this working

userAssignedIdentityResourceId=$(az identity show -g MyResourceGroupName -n MyUserAssignedIdentityName --query id -o tsv)
appResourceId=$(az webapp show -g MyResourceGroupName -n MyAppName --query id -o tsv)
az rest --method PATCH --uri "${appResourceId}?api-version=2021-01-01" --body "{'properties':{'keyVaultReferenceIdentity':'${userAssignedIdentityResourceId}'}}"

Link for the doc

answered Nov 04 '22 at 05:46

Jp Naidu

73
1
8

Adding onto this, the docs don't mention it but if you're using ARM/Bicep you can set the `keyVaultReferenceIdentity` that way as well. Would imagine other providers can set this as well. – RiverHeart Dec 30 '22 at 18:46

score 0 · Answer 4 · answered Jul 11 '22 at 07:13

I am facing the same issue while creating resources through terraform.

I have added a key vault access policy for azure function app as well and the issue is gone.

The below part is only for those who are doing terraform.

My config looked like this,

resource "azurerm_key_vault_access_policy" "resource_group_manager" { 
    key_vault_id = module.key_vault_info.key_vault_id 
    tenant_id = data.azurerm_client_config.current.tenant_id 
    object_id = data.azuread_group.manager.id 
    key_permissions = [ "Get", "List", "Create", "Update", "Delete", ] 
    secret_permissions = [ "Get", "List", "Set", "Delete", ] 
}

I have added a key vault access policy only for the azure resource group but not for azure function.

To resolve that,

I have added a key vault access policy for azure function app as well

like below,

resource "azurerm_key_vault_access_policy" "resource_group_manager" { 
    key_vault_id = module.key_vault_info.key_vault_id 
    tenant_id = data.azurerm_client_config.current.tenant_id 
    object_id = data.azuread_group.manager.id 
    key_permissions = [ "Get", "List", "Create", "Update", "Delete", ] 
    secret_permissions = [ "Get", "List", "Set", "Delete", ] 
}

resource "azurerm_key_vault_access_policy" "this" {
    key_vault_id = module.key_vault_info.key_vault_id 
    tenant_id = data.azurerm_client_config.current.tenant_id 
    object_id = azurerm_function_app.this.identity.0.principal_id 
    key_permissions = [ "Get", "List", "Create", "Update", "Delete", ] 
    secret_permissions = [ "Get", "List", "Set", "Delete", ] 
}

"Key vault reference error" in azure web app configuration setting

PROBLEM

EDIT 1:

4 Answers4

Linked