Managing API Keys for Serverless Functions with Azure KeyVault

With my team's ever growing list of interconnected services, serverless functions, external APIs, databases, et.al., we need a way to securely manage and protect all the sensitive information contained therein.

This is not an uncommon use case, and in-fact several high profile breaches over the last few years involved the storage of secure info like API keys in source control. We'll be using Azure KeyVault to manage our sensitive keys, and today we'll look at how to connect an Azure Function to an Azure Key Vault.

Before we get started, this is going to be a zero code demonstration. Our development environment doesn't need access to the KeyVault for you to trigger the function, even with AuthorizationLevel.Function set. We will do the setup purely in Azure, and show you how to setup role based access. I'm going to assume you are familiar with Azure and know how to setup new services.

The Microsoft documentation on this authorization scenario points at legacy access control in Azure, so hopefully this post saves you some head scratching. 

 

Create Azure Services

So to get started, you're going to need to create an Azure Function and an Azure KeyVault. When you create your KeyVault, make sure the default "Azure role-based access control" option is selected. For the Azure Function, I used .NET 7 Isolated. All the other settings are up to you and your use-case requirements.

Create a Managed Identity for the Azure Function

First we need to enable Managed Identity in the Azure Function. This part is dead simple. All we need to do is find the menu option and turn it on.

Grant Access to the KeyVault to your Managed Identity

This is the part where the documentation differs from the feature's currently available in Azure. The legacy access control is gone, and you'll need to use role based access control.

Once you've made it here, you'll need to assign access.

 

From here, you need to add the 'Key Vault Secrets Officer' role to your managed identity. Your Azure Function will need read/write access to the vault, because it will automatically populate its API keys to the vault.

Click the role, click next, and you'll see the option to select your Managed Identity.

 When you press Select Members, you'll get the option to select your subscription and the Managed Identity you created.

 Once you're done, click next and it'll take you to the 'Review and Assign' screen.

Configure the Azure Function to use KeyVault for API Keys

Now that permissions are properly configured, all you need to do is point the Azure Function at the Key Vault. To do this, we just need to set some environment variables in the function configuration blade.

Configuration Complete

Once that's done, your function app will populate the keyvault with its master-keys. You can see below that the function API keys are stored in the vault, automatically. You functionKey--default will be the key for your AuthorizationLevel.Function authorization.