While doing a code review of an Azure Function I noticed the following line:
var personalAccessToken = Environment.GetEnvironmentVariable("KeyVault_PersonalAccessToken", EnvironmentVariableTarget.Process);
Could it be that the developer directly stored a secret in an environment variable? Instead of using a secure storage like Azure Keyvault?
Inside the configuration on the Azure Portal I found the following:
@Microsoft.KeyVault(SecretUri=https://sample-vault.vault.azure.net/secrets/personal-access-token/<removedthekey>)
Luckily my assumption was wrong and it turns out that is a feature I wasn’t aware of in Azure (Functions).
To use this feature you first have to create a Managed Service Identity for your Azure Functions app as described here: https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=dotnet#creating-an-app-with-an-identity
Once you have a Managed Service Identity you can add an Access policy in your Azure Keyvault:
Now you can copy the secret identifier from the secret you want to use:
This secret identifier should be added with a special connectionstring to your Azure Function configuration:
@Microsoft.KeyVault(SecretUri={theSecretUri}).
Thanks Dario for teaching me this trick!