Azure Function configuration does not get latest version of Key Vault secret

user_16018960 0
Viewed 911

The function never reads the latest version of the secret. It always reads the first one it was configured to use, i.e. the versioned one. Even after restarting the function or re-publishing it, it always reads the versioned secret it was first configured to use.

Created a function with a versioned Key vault Reference of the form:

 TheSecret
   @Microsoft.KeyVault(SecretUri=https://name.vault.azure.net/secrets/TheSecret/__version__)

and in the Function:

if (!int.TryParse(Environment.GetEnvironmentVariable("TheSecret"), out int theSecret))
{
    theSecret = 10;
}

The first time the function runs it retrieves the specific version of the secret.

Created a new version of TheSecret in the Key Vault and change the function application configuation to the non-versioned type:

TheSecret
@Microsoft.KeyVault(SecretUri=https://name.vault.azure.net/secrets/TheSecret/)
azure-keyvault azure-functions
2 Answers

As you have not specified the version then it uses the latest version in the key valut. As per the document When newer versions become available, such as with a rotation event, the app will automatically update and begin using the latest version within one day. Any configuration changes made to the app will cause an immediate update to the latest versions of all referenced secrets.

There are two ways in which the new value from Azure Key vault secret (referenced in Function app) is loaded:

  1. Automatic (not forced) which happens on a 24-hour basis, as mentioned in document.

  2. Configuration update (forced), which forces fetching the latest secrets while performing site update. The simplest way will be to update any setting in Settings\Configuration followed by a Save on this blade. This will also cause a restart. More details available here.

user_137961360

Regarding things to try, here are a few;

  1. Try removing the trailing slash - that could confuse it (though unlikely)
  2. Alternatively, try using the other syntax form for this, @Microsoft.KeyVault(VaultName={vault_name};SecretName={secret_name})
  3. Stop & start (not restart) the function app (I've seen this make a difference, though it shouldn't in theory)

If all these fail, disable the system msi, re-enable & confirm secret get permissions are assigned within the key vault policies. (note you will have to stop/start the function app after doing this)

user_128699540
Related