Unable to Access Azure Key Vault from Function - Returns Forbidden

Question

I'm trying to get a secret from a key vault using an Azure function, but the key vault returns forbidden when I try to access it. Clearly I'm missing something, but I haven't been able to find another post with the same problem. Code below:

AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
KeyVaultClient kvClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));

//(https://keyvaultname.vault.azure.net/)
var keyVaultUrl = Environment.GetEnvironmentVariable("KeyVaultLocation"); 

//(name of the secret)
var vaultSecretKey = Environment.GetEnvironmentVariable("VaultSecretKey"); 

var value = (await kvClient.GetSecretAsync(keyVaultUrl, vaultSecretKey)).Value;

I'm outputting exceptions to the log, and the last line where I await the value of the secret throws this exception:

Operation returned an invalid status code 'Forbidden'.

I have already registered the function in the key vault's access policies and given it permissions to get secrets, and I've enabled Managed Service Identity for the function. Is there something else I'm missing? I'm at a loss as to why the function can't access the vault.

According to your description, if you have enable MSI and give permission in key vault's access policies, it will work fine. You could check if you have click Save after you give permission in access policies. — Joey Cai
I'm facing the same issue. Enabled MSI for the function app and gave it the required access in the access policy of the KeyVault. But returns Forbidden. One point to note is I can access the KeyVault from a function app I created for testing purpose in my personal subscription, but can't from within my project's subscription. — Kayes

Kzrystof Kzrystof · Accepted Answer · 2018-07-31T20:56:15

Here is how I use the KeyVaultClient in my Azure Function (v2). I have a method that returns an access token based on the app ID and secret configured for the Vault:

/// <summary>
/// Called by the KeyVaultClient instance.
/// </summary>
/// <param name="authority"></param>
/// <param name="resource"></param>
/// <param name="scope"></param>
/// <returns></returns>
private static async Task<string> GetAccessTokenAsync(string authority, string resource, string scope)
{
    var clientCredential = new ClientCredential(Constants.Vault.AppId, Constants.Vault.AppSecret);

    var context = new AuthenticationContext(authority, TokenCache.DefaultShared);

    AuthenticationResult result = await context.AcquireTokenAsync(resource, clientCredential);

    return result.AccessToken;
}

Then, when I actually need to access the vault, I call the following constructor:

...
//  Pushes the encryption to the Key-Vault.
var client = new KeyVaultClient(GetAccessTokenAsync, new HttpClient());

await client.GetSecretAsync(Constants.Vault.Url, vaultSecretKey);

Unable to Access Azure Key Vault from Function - Returns Forbidden

7 Answers