How to permit web app to access keyvault

Question

I have a web app that is updated via a pipeline and CI/CD practices.

I need it to access key vault, but it's ip address will change after each update, so cannot pass a single ip.

will setting up a virtual network work?

I am trying to set up a virtual network and tried the following:

obtain the virtual ip address of the web app

then try to create a virtual network from keyvault

but am having issues with the address space and address range

How can I overcome this

Answer 1

Hello @Huhn, Alexander

You error means that you should use address range within address space 10.1.0.0/24.
Address range could be 10.1.0.0/29

To access Key Vault securely you can enable Azure Managed Identity in Azure App Service and grant access to use Key Vault.

https://learn.microsoft.com/en-us/samples/azure-samples/app-service-msi-keyvault-dotnet/keyvault-msi-appservice-sample/
https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal

Then you can reference KeyVault secrets in Azure App Service Settings.

https://intelequia.com/blog/post/2070/storing-azure-app-service-secrets-on-azure-key-vault

If you want to integrate KeyVault into Virtual Network, you can use Private or Service Endpoint
https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal
https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints

Answer 2

@Huhn, Alexander

Thank you for your post!

Adding onto what was shared by @Andriy Bilous, you can grant your Web App access to your Key Vault by using a managed identity to authenticate your web app to your key vault. For more info - Tutorial: Use a managed identity to connect Key Vault to an Azure web app in .NET

Using a System Assigned Managed Identity:

1. From your Azure Web App, select Identity from the left menu.
2. Turn the Status On.
3. Once your System Assigned Identity is created, copy the Object ID.
4. Navigate to your Azure Key Vault Access Policies.
5. Create a new Access Policy, search for/paste your Web Apps System Assigned Identity Object ID. Assign a managed identity access to a resource by using the Azure Portal

Additional Links:

• Managed identity best practice recommendations
• Assign a managed identity access to a resource by using the Azure Portal
• How to use managed identities for App Service and Azure Functions

I hope this helps!

Thank you for your time and patience throughout this issue.