python-3.x - 从 Function App 读取 Azure Key Vault Secret

Question

此 Python 脚本部署为从 Linux 消耗计划上的 Azure Function App 运行，此脚本预计将从 Azure Key Vault 读取机密。

除代码部署外，还进行以下配置

1. 为 Azure Function App 启用系统分配的托管访问
2. Azure Key Vault 的角色分配使用Reader角色引用此函数应用。

这是来自的脚本__init.py__

import azure.functions as func
import os
from azure.identity import ManagedIdentityCredential
from azure.keyvault.secrets import SecretClient

def main(mytimer: func.TimerRequest) -> None:
    identity = ManagedIdentityCredential()
    secretClient = SecretClient(vault_url="https://vault-name.vault.azure.net/", credential=identity)
    secret = secretClient.get_secret('secret-name').
    print (secret.value)

此函数应用程序需要以下库并在requirements.txt文件中定义

azure-functions
azure-keyvault-secrets
azure-identity

此函数运行并以异常结束。

Result: Failure Exception: HttpResponseError: (Forbidden) The user, group or application 'appid=6fb8XXXX-bba6-4fa7-8a76-a193XXXXd8d7;oid=e4c1XXXX-602d-44b7-a2e6-f646XXXXe360;iss=https://sts.windows.net/320bXXXX-7580-46ef-a61a-7f3fXXXXbe8f/' does not have secrets get permission on key vault 'vault-name;location=northcentralus'. 
For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287 Stack: 

File "/azure-functions-host/workers/python/3.7/LINUX/X64/azure_functions_worker/dispatcher.py", 
line 315, in _handle__invocation_request self.__run_sync_func, invocation_id, fi.func, args) File "/usr/local/lib/python3.7/concurrent/futures/thread.py", 
line 57, in run result = self.fn(*self.args, **self.kwargs) File "/azure-functions-host/workers/python/3.7/LINUX/X64/azure_functions_worker/dispatcher.py", 
line 434, in __run_sync_func return func(**params) File "/home/site/wwwroot/FunctionAppName/__init__.py", 
line 14, in main secret = secretClient.get_secret('secret-name') File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/core/tracing/decorator.py", 
line 83, in wrapper_use_tracer return func(*args, **kwargs) File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/keyvault/secrets/_client.py", 
line 71, in get_secret **kwargs File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/keyvault/secrets/_shared/_generated/v7_0/operations/_key_vault_client_operations.py", 
line 1625, in get_secret map_error(status_code=response.status_code, response=response, error_map=error_map) File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/core/exceptions.py", 
line 102, in map_error raise error

此错误描述应用程序在 Key Vault 上没有 Secrets 获取权限，但如上所述，角色分配是在 Key Vault 上具有 Reader 角色的 Function App 进行的。

配置可能出现什么问题以及如何缓解？

标签： python-3.xazureazure-functionsazure-keyvaultazure-managed-identity

Answer 1

为了读取机密，您实际上需要创建访问策略并添加与您的 Azure 函数相关的托管标识：