I have a Azure function app (v1), I noticed calls to it stopped, on inspection the code at the end of the url had changed. I am certain it worked before in previous day, this code I believe comes from the key, we have used it in our calling app.
No deployments have occurred to the app for many days. Do microsoft turn these keys every so often? Could there be any other reason it changed?
AFAIK, Azure doesn't rotate function secrets in silence unless
We change AzureWebJobsSecretStorageType in Application settings.
We happen to delete files containing keys.
Explanation:
Azure Functions currently supports two key storage mechanisms: file system and blob storage.
By default Functions V1 use file system, V2 use blob. We can set AzureWebJobsSecretStorageType to switch the mode. Secrets are regenerated other than being copied the first time we switch the mode.
For file system, we can find the encrypted secrets on kudu(https://functionappname.scm.azurewebsites.net/DebugConsole) and navigate to D:\home\data\functions\secrets.
If our Function app is on consumption plan, we can also trace them in Storage account specified by WEBSITE_CONTENTAZUREFILECONNECTIONSTRING(same as AzureWebJobsStorage by default if we don't change), under File Share named by app setting WEBSITE_CONTENTSHARE, directory home\data\functions\secrets.
For blob, go to blob container azure-webjobs-secrets in the Storage account specified by AzureWebJobsStorage app setting.
If we accidentally delete those file, Azure will generate new secrets.
You may be running into a rare race condition in key generation. There is a fix for it that should be released by the end of next week. The PR that fixed it is here: https://github.com/Azure/azure-functions-host/pull/3590.
