Feature request: retrieve Azure Functions' secrets from Key Vault

All our secrets are in Key Vault so we need a way for Azure Functions to retrieve them from there instead of looking them up in app settings. In function.json, connection strings could referenced using Key Vault URLs:

{
    "disabled": false,
    "bindings": [
        {
            "name": "myQueueItem",
            "queueName": "myqueue-items",
            "connection":"https://xxx.vault.azure.net:443/secrets/yyy",
            "type": "queueTrigger",
            "direction": "in"
        }
    ]
}

Connecting to Key Vault requires us to pass a client cert for app authentication, so the WEBSITE_LOAD_CERTIFICATES app setting will be needed.

[parad0xchild]

@sjwaight There is another problem with Key Vault not being directly integrated to retrieve keys. While you can code the connection in via Cert, SAS, or other means, if you have a highly scalable Azure Function (thousands of instances at once) you will over load the Key Vault with requests from the same IP address (leaving it with no open ports to fulfill requests). This will result in a failure in your function and an error like “Only one usage of each socket address (protocol/network address/port) is normally permitted”.

What really is needed is for a connection from the Azure Function to Key Vault so that you can define which secret or key you want, the orchestration to pull it out periodically and make it available to the function via an input variable. This will ensure you don’t make tons of unnecessary calls to the key vault resulting in a failure.

[CrazyTuna]

I’ve managed to get this working with Azure Function v2:

How to retrieve Azure Functions secrets from Key Vault

It uses the Microsoft.Extensions.Configuration.AzureKeyVault nuget package

I’ve added a startup script:

using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using System.Linq;

[assembly: WebJobsStartup(typeof(FunctionApp1.WebJobsExtensionStartup), "A Web Jobs Extension Sample")]
namespace FunctionApp1
{
    public class WebJobsExtensionStartup : IWebJobsStartup
    {
        public void Configure(IWebJobsBuilder builder)
        {
            // Gets the default configuration
            var serviceConfig = builder.Services.FirstOrDefault(s => s.ServiceType.Equals(typeof(IConfiguration)));
            var rootConfig = (IConfiguration)serviceConfig.ImplementationInstance;

            // Creates a new config based on the default one and adds the keyvault configuration builder
            var keyvaultName = rootConfig["keyVaultName"];
            var config = new ConfigurationBuilder()
                .AddConfiguration(rootConfig).AddAzureKeyVault($"https://{keyvaultName}.vault.azure.net/").Build();

            // Replace the existing config
            builder.Services.AddSingleton<IConfiguration>(config);
        }
    }
}

So:

• The function app need to use MSI
• The function app need to have at least Read/List secrets permissions in the key vault.
• The keyvaultName settings need to be presetn in your local.settings.json or app settings blade of the function app.