Search code examples
c#azureazure-functionsazure-managed-identity

Replacing connection string to managed Identity for azure blob trigger > Azure function app from VS to azure portal

I have performed the following

  1. Created a simple azure blob triggered function app in visual studio with default setup
  2. Publish into Azure portal and the trigger is set to a different azure blob location

Requirement is to Relplace azure blob connection string with function app Managed identity

  1. I followed this blog which mentions simple setup but in my case the connection string is a different one so I am not sure if this work Function app in portal

Can you please help to identify

  1. Steps to follow in order to replace with managed identity in Visual studio for this case
  2. Versions of function app and azure blob supports managed identity

I also found this blog which resonates the requirement however I am not sure how to perform this in VS and sync to azure portal for my current function app

thanks

Solution

  • I successfully ran the Blob trigger function locally and in the Azure Function App using DefaultAzureCredentials and Managed Identity.

    As mentioned in this MS DOC.

    • The Blob Trigger manages failures after multiple retries by writing poison blobs to a queue. When using the serviceUri format, the AzureWebJobsStorage connection is required.

    • If blobServiceUri is specified, you must also include the queueServiceUri in the local.settings.json.

    • You can use the Blob and Queue service URIs in place of the connection string in the local environment (e.g., Visual Studio).

    local.settings.sjon :

    {
    "IsEncrypted": false,
  "Values": {
    "AzureWebJobsStorage": "UseDevelopmentStorage=true",
    "FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
    "BlobConnection__blobServiceUri": "https://<storagename>.blob.core.windows.net/",
    "BlobConnection__queueServiceUri": "https://<storagename>.queue.core.windows.net/"
  }
}

    Function1.cs :

    using Microsoft.Azure.Functions.Worker;
using Microsoft.Extensions.Logging;
 
namespace FunctionApp4
{
    public class Function1
    {
        private readonly ILogger<Function1> _logger;
 
        public Function1(ILogger<Function1> logger)
        {
            _logger = logger;
        }
 
        [Function(nameof(Function1))]
        public async Task Run([BlobTrigger("kamcontainer/{name}", Connection = "BlobConnection")] Stream stream, string name)
        {
            using var blobStreamReader = new StreamReader(stream);
            var content = await blobStreamReader.ReadToEndAsync();
            _logger.LogInformation($"C# Blob trigger function Processed blob\n Name: {name} \n Data: {content}");
        }
    }

    Program.cs :

    using Microsoft.Azure.Functions.Worker.Builder;
using Microsoft.Extensions.Hosting;
 
var builder = FunctionsApplication.CreateBuilder(args);
builder.ConfigureFunctionsWebApplication();
builder.Build().Run();

    I have created a Service principle in Azure AD and added the clientID, clientSecret and TenantID to the System Environment Variables to run the function using DefaultAzureCredentials as shown below.

    enter image description here

    Add below to your System Environment Variables :

    AZURE_CLIENT_ID = <clientID>
AZURE_CLIENT_SECRET = <clientSecret>
AZURE_TENANT_ID = <TenantID>

    enter image description here

    I have Enabled the Manged Identity in the Azure Function App as shown below.

    enter image description here

    I have assigned the Storage Blob Data Owner role to the Service Principal and the Storage Blob Data Contributor role to the Function App under Access Control (IAM) in the Storage account, as shown below.

    enter image description here

    Local Output :

    I started running the Blob trigger function and upload a file in the Blob storage as shown below.

    enter image description here

    The Blob Trigger function ran successfully and retrieved the blob details, as shown below.

    enter image description here

    I have updated the below in the function app > Environment Variables > App settings and published the Blob trigger function to the Azure Function App, as shown below.

    "BlobConnection__blobServiceUri": "https://<storagename>.blob.core.windows.net/",
"BlobConnection__queueServiceUri": "https://<storagename>.queue.core.windows.net/"

    enter image description here

    Azure Function App Output :

    I successfully ran the Blob Trigger function in the Azure Function App and retrived the blob details, as shown below.

    enter image description here