Skip to main content

Azure KV and FuncApp


1. Create a FunctionApp and add a system assigned identity to it. Create on the search bar and select func app. The go to the identity section and turn on the status button. This creates an identity and registers the func app in azure ad. Now we need to grant this identity permissions to read from KV




2. Create a Keyvault and create a secret. I have created 2 (Name = Anish and surname = Aravind)
















3. Give the function app identity access to read the secrets from Keyvault



4. Select the certificates drop down and select Get and List. Since we need to read the secrets. 


5. Save the changes















6. Go to the Configuration section in the function app and add the following values. Cliick on create new application setting. The setting is a key value pair.  I have created 2 because I need to read 2 secrets from KV. The application setting key will be the key for the secret in KV.

Name : @Microsoft.KeyVault(SecretUri=secretidentifierfor the secret)

To  get the secret identifier for the secret. Go to KV and click on the current version.

 This takes you to a new blade. Copy the secret identifier and use it as the value for the application setting that we created.


Key -- name of the secret 
Value -- @Microsoft.KeyVault(SecretUri=secretidentifierfor the secret)





Now simply read the values from keyvault as environment variables.

public static class Function1
    {
[FunctionName("Function1")]
public static async Task<IActionResult> Run(
[HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
            ILogger log)
{
log.LogInformation("C# HTTP trigger function processed a request.");
log.LogInformation("C# HTTP trigger function processed a request.");

var name = Environment.GetEnvironmentVariable("Name", EnvironmentVariableTarget.Process);
var surname = Environment.GetEnvironmentVariable("surname", EnvironmentVariableTarget.Process);
            
return new OkObjectResult($"Name {name}, Surname {surname}");
        }
    } 

Output:




Comments

Post a Comment

Popular posts from this blog

Azure AD Authentication And Authorization

ROLE BASED AUTHORIZATION Step1:   Setup  API. 1. Create an app registration and create an app role. Make sure that the app role is assigned to user and applications. We add it to both user groups and applications as this role can be then assigned to both users and applications. Scopes can only be assigned to apps. Now we can have only users with this role access our application. This app role behind the scenes adds an approles section to the manifest.json. We can directly add it to the manifest file also. Step 2:  Setup an app registration for the UI/ WEB App. . We will grant this app the read role created in the API app (shown above). Go to Azure AD and select the UI app registration. When we register an application 2 elements get created. 1. App registration  2. Enterprise Application -- service principal that get created for the app Adding roles to applications Go to the App registration => API Persmissions => Add a Permission => My API's The My Api's sec...
Post a Comment
Read more

Service Endpoints --

 1. Create a VNET with 2 subnets 2. Create a service endpoint policy. That enables us to specify which particular storage account to connect to. This is currently enabled for storage accounts alone. Otherwise as part of service endpoints we can specify the resource provider alone and not a specific resource. We can specify this service endpoint policy while creating a service endpoint. Only storage account allow service endpoint policies as of now. If we notice then selecting cosmos db or any other service other than storage will not have the ability to accept service endpoint policies. As mentioned microsoft.storage allows us to add service endpoint policies. Thus we can specify a particular resource within a provider This is 1 way of enabling service endpoints. Or we can directly go to the storage account and from the networking tab select Sub1. This will automatically configure service endpoints and will add a service endpoint policy that enables the resource to connect to the s...
Post a Comment
Read more

Azure Service Bus

Service bus is a refined version of the queue service. We can create topics for PUB/SUB.  Firstly we need to create a namespace, under this namespace we can create queues or topics. The Service bus explorer can be used to send/receive/peek message on the service bus. If we read the message then the message is removed from the queue, whereas with peek we can see the message without removing it. To get to the service bus explorer , create a queue in the service bus namespace An enterprise service bus implements a communication system between mutually interacting software applications in a service-oriented architecture. QUEUE PROPERTIES TIME to Live We can set a common time to live or each message in the queue, this can be done by configuring the TTL at the queue level. Each message can have its own TTL which will override the Queue TTL. LOCK Duration: When we set the lock duration on a message what happens is that once a receiver receives the messages no other receivers or subscribe...
Post a Comment
Read more