Webapp configuration: how to provide reference to key stored in a keyVault

Question

Hi,

In an Azure web app conf, I succeeded in providing a reference to a secret from a KeyVault
Example :
@Microsoft.KeyVault(SecretUri=https://...mykeyvault.vault.azure.net/secrets/MYSECRETNAME/ff7779aef85b46e2xxxxxxxxxxxx)

But I failed to do the same for a key (and not a secret)
Example :
@Microsoft.KeyVault(SecretUri=https://...mykeyvault.vault.azure.net/keys/TESTMYKEY/1080820e517747629ce1xxxxxxxxx)
It does not work !

Error msg : Key Vault Reference Details

Vault Name
...mydevkeyvault

Secret Name
TESTMYKEY

Secret Version
1080820e517747629ce1b96e3a0a6d42

Identity
System assigned managed identity

Status
SecretNotFound

Error Details
Key Vault reference was not able to be resolved because Key Vault reference contains invalid Key Vault secret name that can't be found.

Access policy are set to allow "Get" access.

Could you please help me to figure out what is wrong and how to fix it ?
In advance, thx for your help,
Regards

Answer 1

Hello @Vincent Coucharriere
Please make sure to follow the steps below (total of 8 steps)

1. Enable Identity from your Azure Web App, and copy the value of the identity, you need this in step#3
2. Go to the Key vault and create a secret with value
3. From the key vault Click "Access Policies" Add Access Policy" then select at least "Get" from the secret permissions
4. From the Select principal click "none selected" from the search box paste the GUID copied from step #1 then select and then Add
5. Make sure to click "Save", lots of people miss this step
   
6. go to your web app and add the app settings key
   
7. from the step#3 if you granted "List" permission then you don't need to provide the version part it can be something like @Microsoft.KeyVault(SecretUri=https://[KVNAME].vault.azure.net/secrets/[SECRETNAME]), please note no version is here. in this case, it will always use the latest version, which is preferred if you change the value frequently

Answer 2

You can use @Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret) syntax. I did run into a similar issue but instead of the secret, the vault name wasn't resolved. However, deleting the access policy and recreating it resolved the issue for me. Try that and let me know if that works.

---
EDIT: 2022 Jun 6 For keys, I couldn't find any supported syntax for retrieving keys. In order to retrieve keys in your app, you still need to have the access policies but you would need to use the Azure SDK on whatever platform your app is running. For example, you could have https://<vault-name>.vaul.azure.net be an Application Setting and if your app was .NET

   var keyVaultEndPoint = Environment.GetEnvironmentVariable("KEY_VAULT_NAME");  
     
   var client = new KeyClient(new Uri(keyVaultEndPoint), new DefaultAzureCredential());  
   var key = await client.GetKeyAsync("ExampleKey");