Managed Identity Roles Needed for Azure Functions

Question

I cannot figure out how to give my APIMS instance authorization to execute my Azure Function. When I try to test the Azure Function I get a 403 unauthorized error.

I have an instance of Azure API Management Service (APIMS) Development Tier. I also have an Azure Function (Consumption Tier) configured to run through my AMIPS instance. I have setup the Azure Function to require Authentication. I have also setup my APIMS to use a Managed Identity. I have also given my APIMS Managed Identity the Reader role for my Azure Function through Access Control (IAM).

Is there another role the managed identity of the AMIPS instance needs to run the Azure Function?

Can anyone confirm that my configuration should work? I have seen no one actually confirm this online chats/Q&A/etc. or through any of the tutorials/documentation. While I have followed all the steps to enable and configure Authentication and Managed Identities, I have not seen my specific infrastructure configuration as an example. Can anyone confirm that they can make this work? That way I at least know I am doing something wrong and it is not just Azure.

Answer 1

Hello Jonathan Lewis,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

NOTE: Please, this is my personal way of answering technical questions, and my unique formatting style adopted for clarity and future usage. I am not AI and if I use AI contents, I will cite the source of content in my references as recommended by Microsoft Q&A policy. Thank you.

Problem

I understand that you are attempting to authorize your Azure API Management Service (APIMS) instance to execute an Azure Function but encounters a 403 unauthorized error when testing the function.

Scenario

Your unique scenario, you have an Azure API Management Service (APIMS) instance on the Development Tier and an Azure Function on the Consumption Tier. You want to securely enable your APIMS instance to call the Azure Function. To do this, you've set up a managed identity for the APIMS instance and assigned it the Reader role for the Azure Function. However, when you test the function, you receive a 403 unauthorized error. You need to find out if additional roles or configurations are required and seek confirmation from others who have successfully implemented a similar setup.

Solution

Based on your concerns if your APIMS will work? YES! it will work. You've been doing so great!

This prescribed solution was based on the scenario given and your questions, while focusing on the problem statement. There are few things you will need to put together, and I have classified them into three steps and three workflows.

Step A: Verify Managed Identity Configuration.

You will need to assign the 'Managed Identity Role' by:

• Ensure that the managed identity linked to your APIMS instance has the appropriate permissions.
• In addition to the 'Reader' role, it generally needs the 'Function App Contributor' role to execute the function.

Therefore, to assign this role, from the same place you assign 'Reader Role':

• Open the Azure portal and go to your Function App.
• Click on 'Access control (IAM)'.
• Select 'Add role assignment'.
• Choose the 'Function App Contributor' role.
• Assign it to the managed identity of your APIMS instance.

Step B: Configure APIMS to Use Managed Identity for Authentication.

Yupo will need to set up the Authentication Policy in APIMS, when you open your APIMS instance in the Azure portal. you will go to 'APIs' and select the API that points to your Azure Function. In the 'Design' tab, navigate to the 'Frontend' section. Add an inbound policy to utilize the managed identity for authentication. Use the following policy XML as an example:

<inbound>
       <base />
       <set-header name="Authorization" exists-action="override">
           <value>Bearer @(context.Request.Headers.GetValueOrDefault("Authorization"))</value>
       </set-header>
   </inbound>

Also, configure the Function App to Accept Managed Identity Tokens to ensure your Azure Function app is set to accept tokens from the APIMS managed identity. Therefore, navigate:

• Azure portal, go to your Azure Function app.
• Navigate to 'Authentication / Authorization'.
• Enable 'App Service Authentication'.
• Add a new provider and select 'Azure Active Directory'.
• Set up the provider to accept tokens from the APIMS managed identity.

Step C: Configure the Function App to Accept Managed Identity Tokens

You will need to validate Token Issuance to obtain a Token Using Managed Identity:

Confirm that your APIMS can get a token from Azure Active Directory for the managed identity.

Test this with a REST client like Postman:

• Request a token for the managed identity.
• Use this token to call your Azure Function directly.

This is an example command to get a token using the Azure CLI:

az account get-access-token --resource <resource-uri-of-your-function-app> --mi

If you have done all this.

Finally, Test the Configuration by using a client like Postman to test the APIMS endpoint and verify that it returns the expected result without a 403 error.

References

The main source of the information provided are listed here, you can read more from the link:

Source: Manually run a non HTTP-triggered Azure Functions. Accessed, 5/21/2024.

Source: Allow the Functions access only via APIM from Stack Overflow. Accessed, 5/21/2024.

Source: Which permission allows triggering of an Azure Function from Stack Overflow. Accessed, 5/21/2024.

More: Kindly, read from the additional resources provided by the right side of this page.

Accept Answer

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful ** so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam