Fetch value from Azure Key Vault reference (Managed identity)

Question

I am trying to fetch secret values from azure key vault in Azure App Service. My App Service has a managed identity In the Azure Key vault, this managed identity is added under 'Role assignments' as 'Key vault contributor' Also access policies has been added in azure key vault to give 'Get' permission to the AppServices's managed identity Now in my c# code, I am trying to get the value of the AppSetting element using the code ConfigurationManager.AppSettings['something'];

In my azure app service, under app settings, I have added the a key with name 'something' and it has the value pointing to the reference of the Key Vault as below:

@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/ec96f02080254f109c51a1f14cdb1931)

Now I am able to retrieve the value from the appsettings, but instead of the actual value, it is pulling the output as @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/c96f02080254f109c51a1f1cdb1931)

I am expecting the output to be value that I have set, not the keyvault reference string itself.

I am using .Net MVC 4.7 web app

You don't need to add any RBAC permissions by the way. Key Vault uses only Access policies to authorize requests for secrets etc. — juunas
Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used. - are you using a system assigned one? there are several other things in this article that are crucial for this to work: docs.microsoft.com/en-us/azure/app-service/… — 4c74356b41

Joey Cai Joey Cai · Accepted Answer · 2020-02-18T12:08:50

As junnas said, you just add webapp's MSI in key vault Access policy.

1.Turn on webapp System-assign managed identity.

2.Add the identity into keyvault Access policy with secret Get permission.

3.Add the reference of the Key Vault into webapp Application settings.

4.Use Environment.GetEnvironmentVariable("AppsettingName"); to get the secret vaule.

Here is the output:

Fetch value from Azure Key Vault reference (Managed identity)

2 Answers