保护 Azure 函数使用的私钥

Question

我有一个 Azure 函数，它将文件从 SFTP 位置复制到 Azure Blob。 建立与 SFTP 的连接所需的私钥/SSH 密钥现在是应用程序设置 json 的一部分 - 因为该解决方案仍受限于 PoC/开发阶段。

在为生产排好队之前，我必须确保上述私钥的安全。

Azure Key Vault 是我可以存储私钥的最佳候选者吗？并通过 AD 配置 Azure Function 对此密钥的动态访问？

或者从 Azure PaaS 的角度来看是否有替代方法？

Answer 1

我个人没有从 Azure Function 访问 Azure Key Vault 中的机密。到目前为止，我发现将密钥/密钥存储在 Function App 的应用程序设置中非常适合我。

但是，您可能会发现这很有用： Retrieve Azure Key Vault Secrets using Azure Functions and Managed Service Identity 按照该页面中描述的步骤正确设置保险库后，您可以像这样从函数访问：

using System.Net;
using System.Configuration;
using Microsoft.Azure.Services.AppAuthentication;
using Microsoft.Azure.KeyVault;
using Microsoft.Azure.KeyVault.Models;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Newtonsoft.Json;
using System.Text;

public static async Task<HttpResponseMessage> Run(HttpRequestMessage req, TraceWriter log)
{
    log.Info("C# HTTP trigger function processed a request.");

    SecretRequest secretRequest = await req.Content.ReadAsAsync<SecretRequest>();

    if(string.IsNullOrEmpty(secretRequest.Secret))
        return req.CreateResponse(HttpStatusCode.BadRequest, "Request does not contain a valid Secret."); 

    log.Info($"GetKeyVaultSecret request received for secret {secretRequest.Secret}");        

    var serviceTokenProvider = new AzureServiceTokenProvider();

    var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(serviceTokenProvider.KeyVaultTokenCallback));            

    var secretUri = SecretUri(secretRequest.Secret);
    log.Info($"Key Vault URI {secretUri} generated");
    SecretBundle secretValue; 
    try
    {
      secretValue = await keyVaultClient.GetSecretAsync(secretUri);
    }
    catch(KeyVaultErrorException kex)
    {
        return req.CreateResponse(HttpStatusCode.NotFound, $"{kex.Message}");
    }
    log.Info("Secret Value retrieved from KeyVault.");

    var secretResponse = new SecretResponse {Secret = secretRequest.Secret, Value = secretValue.Value};

    return new HttpResponseMessage(HttpStatusCode.OK) {
        Content = new StringContent(JsonConvert.SerializeObject(secretResponse), Encoding.UTF8, "application/json")};


}

public class SecretRequest
{
    public string Secret {get;set;}
}

public class SecretResponse
{
    public string Secret {get; set;}
    public string Value {get; set;}
}

public static string SecretUri(string secret)
{
   return $"{ConfigurationManager.AppSettings["KeyVaultUri"]}/Secrets/{secret}";
}