Troubleshooting Keyvault access from Azure VM

Question

I need to deploy a .Net Core 2.2 app to an Azure VM and I must read some credentials from Azure Keyvault.

I do not have full control on the environment.

I followed this tutorial Use Azure Key Vault with a Windows virtual machine in .NET as much as I could, but actually the VM had already been created by sysadmin.

I created the KeyVault in the same resource group of the VM and added 2 secrets.
I checked that the VM is registered in Active Directory and that it has a system assigned identity.
I added to my Keyvault an access policy allowing read and list secrets to my VM.
I tried the sample application in the tutorial.
- If I run it from Visual Studio on my pc (using the Azure Cli to authenticate with AZ LOGIN) I can get the secrets
- If I deploy the app in my Azure VM I get an "Identity not found" exception when I try to get the token
I also tried to get the token using powershell on the VM:

$response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net/'-Method GET -Headers @{Metadata="true"}

and I get this error

Invoke-WebRequest : {"error":"invalid_request","error_description":"Identity not found"}
At line:1 char:13
+ $response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/i ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

If I use the https (the tutorial uses http, but just to be on the safe side I tried also the https variant)

$response = Invoke-WebRequest -Uri 'https://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net/' -Method GET -Headers @{Metadata="true"}

there is a noticeable delay then I get this:

Invoke-WebRequest : Unable to connect to the remote server
At line:1 char:13
+ $response = Invoke-WebRequest -Uri 'https://169.254.169.254/metadata/ ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand

Do you see any mistake in my settings or have some troubleshooting suggestion?

Nancy Xiong Nancy Xiong · Accepted Answer · 2019-04-11T03:04:50

I can reproduce this error, the error probably indicates that Identity not found. I suggest checking again if you have assigned correctly the system assigned identity in the Azure portal.

Verify if the sysytemAssignedIdentity when you create it using Az CLI command is the same as the object ID in the Virtual machine panel. If you have many tenants, make sure you create the system assigned Identity in the right tenant.

Once I create the identity for the Azure VM, the error disappears. It seems that you do not need to use https, I get the same error Unable to connect to the remote server as you.

Troubleshooting Keyvault access from Azure VM

1 Answers