从 Function App 读取 Azure Key Vault Secret

Question

此 Python 脚本部署为在 Linux 消耗计划上从 Azure Function App 运行，此脚本预计将从 Azure Key Vault 读取机密。

除了代码部署，还有以下配置

1. 为 Azure Function App 启用系统分配的托管访问
2. Azure Key Vault 的角色分配以Reader 角色引用此函数应用。

这是来自__init.py__的脚本

import azure.functions as func
import os
from azure.identity import ManagedIdentityCredential
from azure.keyvault.secrets import SecretClient

def main(mytimer: func.TimerRequest) -> None:
    identity = ManagedIdentityCredential()
    secretClient = SecretClient(vault_url="https://vault-name.vault.azure.net/", credential=identity)
    secret = secretClient.get_secret('secret-name').
    print (secret.value)

此函数应用需要以下库并在requirements.txt 文件中定义

azure-functions
azure-keyvault-secrets
azure-identity

此函数运行并以异常结束。

Result: Failure Exception: HttpResponseError: (Forbidden) The user, group or application 'appid=6fb8XXXX-bba6-4fa7-8a76-a193XXXXd8d7;oid=e4c1XXXX-602d-44b7-a2e6-f646XXXXe360;iss=https://sts.windows.net/320bXXXX-7580-46ef-a61a-7f3fXXXXbe8f/' does not have secrets get permission on key vault 'vault-name;location=northcentralus'. 
For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287 Stack: 

File "/azure-functions-host/workers/python/3.7/LINUX/X64/azure_functions_worker/dispatcher.py", 
line 315, in _handle__invocation_request self.__run_sync_func, invocation_id, fi.func, args) File "/usr/local/lib/python3.7/concurrent/futures/thread.py", 
line 57, in run result = self.fn(*self.args, **self.kwargs) File "/azure-functions-host/workers/python/3.7/LINUX/X64/azure_functions_worker/dispatcher.py", 
line 434, in __run_sync_func return func(**params) File "/home/site/wwwroot/FunctionAppName/__init__.py", 
line 14, in main secret = secretClient.get_secret('secret-name') File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/core/tracing/decorator.py", 
line 83, in wrapper_use_tracer return func(*args, **kwargs) File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/keyvault/secrets/_client.py", 
line 71, in get_secret **kwargs File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/keyvault/secrets/_shared/_generated/v7_0/operations/_key_vault_client_operations.py", 
line 1625, in get_secret map_error(status_code=response.status_code, response=response, error_map=error_map) File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/core/exceptions.py", 
line 102, in map_error raise error

此错误描述应用程序没有获得 Key Vault 上的 Secrets 权限，但如上所述，角色分配是针对具有 Key Vault 上的 Reader 角色的 Function App 进行的。

配置可能出现什么问题以及如何缓解？

Answer 1

为了读取机密，您实际上需要创建访问策略并添加与您的 Azure 函数相关的托管标识：

Answer 2

您还可以使用 azure-mgmt-keyvault 库通过 Azure SDK 更新 Key Vault 访问策略。下面是一个示例，说明如何授予应用获取机密的权限，这将解决您的问题：

from azure.identity import ManagedIdentityCredential
from azure.mgmt.keyvault import KeyVaultManagementClient
from azure.mgmt.keyvault.v2019_09_01.models import AccessPolicyEntry, AccessPolicyUpdateKind, SecretPermissions, Permissions, VaultAccessPolicyParameters, VaultAccessPolicyProperties

subscription_id = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
tenant_id = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
object_id = "object ID of your app"
client_id = "client ID of your app"

credential = ManagedIdentityCredential()
client = KeyVaultManagementClient(credential, subscription_id)

permissions = Permissions(secrets=[SecretPermissions.get])
access_policy = AccessPolicyEntry(
    tenant_id=tenant_id,
    object_id=object_id,
    application_id=client_id,
    permissions=permissions
)
access_policy_property = VaultAccessPolicyProperties(access_policies=[access_policy])
access_policy_params = VaultAccessPolicyParameters(properties=access_policy_property)

client.vaults.update_access_policy(
    resource_group_name="resource-group",
    vault_name="vault-name",
    operation_kind=AccessPolicyUpdateKind.add,
    parameters=access_policy_params
)

（我使用 Python 开发 Azure SDK）