Connecting to MySQL using Managed Identity in Azure Function

Question

Hi

I am trying to use a managed identity to read&write a mysql from an Azure function (pytho http trigger).

I created a User Managed Identity from the portal by going to my MySQL db -> Authentication -> Select Identity -> Create. I named it "mysql_mi".

I gave permission to mysql_mi to access my DB through the following (portal): MySQL db -> Access Control (IAM) -> Add Role Assignment -> selected Privileged administrator roles -> selected Contributor. On the Members tab selected Managed identity and selected mysql_mi.

Is this the right way to assign permission to my managed identity?

Finally, in my python code I followed https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/app-service/tutorial-connect-msi-azure-database.md

from azure.identity import DefaultAzureCredential
import mysql.connector
import os

# Uncomment one of the two lines depending on the identity type
#credential = DefaultAzureCredential() # system-assigned identity
#credential = DefaultAzureCredential(managed_identity_client_id='<client-id-of-user-assigned-identity>') # user-assigned identity

# Get token for Azure Database for MySQL
token = credential.get_token("https://ossrdbms-aad.database.windows.net/.default")

# Set MySQL user depending on the environment
if 'IDENTITY_ENDPOINT' in os.environ:
    mysqlUser = '<mysql-user-name>@<server-name>'
else:
    mysqlUser = '<aad-user-name>@<server-name>'

# Connect with the token
os.environ['LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN'] = '1'
config = {
  'host': '<server-name>.mysql.database.azure.com',
  'database': '<database-name>',
  'user': mysqlUser,
  'password': token.token
}
conn = mysql.connector.connect(**config)
print("Connection established")

In this code, I am not sure about what <mysql-user-name> and <aad-user-name> are.

Can someone help clarify?

I tried replacing both with mysql_mi but it doesn't work. It seems that I am getting the crendential and the token right (code above) but still get an "Can't connect to MySQL server" exception.

Any pointer or suggestion would be greatly appreciated.

Thanks in advance!

Answer 1

@JDR Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

I understand that you are trying to use a managed identity to read and write to a MySQL database from an Azure Function (Python HTTP trigger). You have created a User Managed Identity from the portal and given it permission to access the database.

Please follow the below article which explains how to connect to Azure Database for MySQL using Managed Identity of Function App:

https://techcommunity.microsoft.com/t5/azure-database-for-mysql-blog/how-to-connect-to-azure-database-for-mysql-using-managed/ba-p/1518196

If you run into the issue after following the above plan please let me know. I would be happy to help.

**

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.