azure - keyVaultClient - get a secret

Question

I am using Azure function to do an action, in this action I need to get a secret from a keyvault. I am using this code in order to get the secret

 var azureServiceTokenProvider = new AzureServiceTokenProvider();
 var keyVaultClient = new KeyVaultClient((authority, resource, scope) => azureServiceTokenProvider.GetAccessTokenAsync(resource));

var secret= await keyVaultClient.GetSecretAsync($"https://{KeyVaultName}.vault.azure.net/", "SecretName");

When I run it locally it's work but when I run the function in azure I am getting an error "Forbidden" How can I get the secret from a keyVault inside my azure function?

Thanks!

Answer 1

Forbidden might indicate that the identity assumed by the Azure Function does not have access rights over the specific Azure Key Vault.

From the Azure Portal or via CLI/API, head into the relevant Azure Key Vault resource -> Access Policies -> Add Access Policy -> Assign the Azure Function identity with the following permissions:

• Secret List
• Secret Get