Access KeyVault from AzureFunciton with public network disabled

Question

I have an azure function that needs to access key-vault.

The code looks like this:

credentials = DefaultAzureCredential()
secret = secret_client.get_secret(secret_name)

Locally, It works with the following settings:
KeyVault -> Settings -> Networking -> Allow public access (either my local IP or all networks, both works)

But I don't want to allow all public networks to be able to access the vault.

When disabling "Allow public access" and deploying the Function to Azure, I get this error:
(Forbidden) Public network access is disabled and request is not from a trusted service nor via an approved private link.

I expected such error when trying to run it locally, because my local IP is obviously not allowed. But i expected it to work when deployed, because i thought, the AzureFunction was a "trusted service", but it is not listed here.

Also, I have added role-based access and I have added the Azure-Function. As said, this works when I allow public access, which I don't want. Is there any way to restrict public access to the vault but make it available for the AzureFunction?

Answer 1

@previousversiondocs

Thank you for your post!

Error Message:

(Forbidden) Public network access is disabled and request is not from a trusted service nor via an approved private link.

I understand that you're trying to access your Key Vault from your Azure Functions App and are running into the above error message due to your Vault's public network being disabled. When it comes to troubleshooting your issue, I'll share some options below to hopefully point you in the right direction.

Public Access Disabled:

• When it comes to the Public Access Disabled Firewall and VNET setting, this will deny all public configurations and allow only connections through private endpoints. For more info - Create a private endpoint by using the Azure portal.

Managed identities Azure Functions:

• If you don't want to "Allow public access from all networks" but you're able to "Allow public access from specific virtual networks and IP addresses" - you can create a system-assigned identity for your Azure Functions App, assign it the appropriate Key vault permissions, and access your Key Vault through the system-assigned identity.

Allow public access from specific virtual networks and IP addresses:

• If you choose to leverage Virtual networks and IP addresses, you can also add your Function App's IP address to your Key Vaults firewall to allow for access. If you aren't sure of the IP address used, you can use your browser's Developer Tool (F12) or Capture a Fiddler Trace.
• Once you figure out what IP is being blocked, you can then add it your IPv4 addresses as 12.345.678.901 or 12.345.678.0/24
• 

Key Vault Access Policies:

• I also noticed you mentioned assigning the RBAC role to your Azure Function. Depending on your Vault's Access Configuration, you might have to assign the appropriate Access Policy permissions to your Functions App.

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

Additional Link:

• Create a function app that uses Key Vault for necessary secrets

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.