How do you reference a Key from Azure Key Vault in a function app?

Question

I've used quite a few secrets for Azure Functions in the past, and now I am trying to use a Key, RSA encrypted , 4096 bits. It's a private PuTTy .ppk key, which I've exported to a .pem type to match Azure's requirements. I have a Python 3.7 App in which I have deployed the needed function and I have tried to reference in the Application Settings the needed key with the following statement :

@Microsoft.KeyVault(SecretUri=https://{thevault-address}.vault.azure.net/keys/{thekey-name}/)

as well as

@Microsoft.KeyVault(SecretUri=https://{thevault-address}.vault.azure.net/keys/{thekey-name}/latestVersionHash)

But when I try to save it , it says that the reference could not be resolved.

The application has Identity On and the Vault has access policies for the Function configured for secrets as Get and List and for Keys as everything (initially just Get and List but added the rest just in case, because I thought that it might be an 'encription/decription' issue).

And idea why am I getting the Status:InvalidSyntax and Error Details: Key Vault reference was not able to be resolved because invalid Key Vault reference syntax found ? Thanks !

Answer 1

The process you described above is perfectly correct to reference a Secret.That is why in the string @Microsoft.KeyVault(SecretUri= you set SecretUri equals to...

For Keys thow, that would not be possible. A Key cannot be referenced by an azure web app.

---

To clear any confusion in order to reference a secret to Azure KeyVault from a web app you need three points

1. You application identity On
2. Set policies in in Keyvault so your app would be able to access the value
3. In your web app, in Configuration tab you set the value of your variable as @Microsoft.KeyVault(SecretUri={Secret Identifier}).

Secret identifier can be found if you go to your Keyvault resource and click your secret

The identity value needs to be identical.