access azure key vault from azure web app where ip changes often bc of CI/CD

Question

I have a docker container that accesses azure key vault. this works when I run it locally.

I set up an azure web app to host my container, and it cannot access the key vault

I followed the suggestion from https://www.youtube.com/watch?v=QIXbyInGXd8 and I went to the web app in the portal to set status to on

Created an access policy

and then receive the same error with a different ip

My web app ip address would change every time an update were made, so are there any suggestions how to overcome this?

Answer 1

Hello @Huhn, Alexander

The error "Client address is not authorized and caller is not a trusted service in Azure" shows that your client IP address is not authorized.

In Azure KeyVault Settings you can allow access to KeyVault from "All networks" and not "Selected networks"

If you really need to limit access to KeyVault from Azure App Service, integrate Azure App Service into Virtual network and link KeyVault using Service or Private Endpoint.
https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal
https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints

https://stackoverflow.com/questions/52985252/client-address-is-not-authorized-and-caller-is-not-a-trusted-service-in-azure

Answer 2

You can grant access to trusted Azure services by configuring networking settings. For step-by-step guidance, see the networking configuration options of this article.

When you grant access to trusted Azure services, you grant the following types of access:

• Trusted access for select operations to resources that are registered in your subscription.
• Trusted access to resources based on a managed identity.
• Trusted access across tenants using a Federated Identity Credential

See here: step-by-step instructions to configure Key Vault firewall and virtual networks by using the Azure portal, Azure CLI and Azure PowerShell

Answer 3

While working through this issue, I determined that 5 specific IP addresses were being used while the final product was launched.

I whitelisted these 5 addresses, and it fixed the issue.