Function App connection to KeyVault through VNET

Having an issue with an Azure Function App not being able to Keyvault, Function-App configured with VNET and KeyVault configured with same VNET and Firewall. All built with Terraform

Function app configuration was complaining of not being able to find the KeyVault.


Ran the troubleshooting to review the vnet config and most everything came back clean.


Still no dice on the keyvault connection. Was reading about adding the "Custom Domain IP" for the function app to the keyvault firewall. I added that and it worked.
(where y.y.y.y/32 is the function app ip)

```
network_acls {
bypass = "AzureServices"
default_action = "Deny"
ip_rules = ["x.x.x.x/x", "x.x.x.x/x", "x.x.x.x/x","y.y.y.y/32"]
virtual_network_subnet_ids = [data.azurerm_subnet.subnet.id]
}
```

I got to thinking and talking with my team, it should work without it because of the vnet integration and wanted to troubleshoot more.
Removed the Function App IP from the firewall and It's still working?!
```
network_acls {
bypass = "AzureServices"
default_action = "Deny"
ip_rules = ["x.x.x.x/x", "x.x.x.x/x", "x.x.x.x/x"]
virtual_network_subnet_ids = [data.azurerm_subnet.subnet.id]
}
```

Its almost as if you had to give it a nudge and it worked itself out. It's really strange.

Anyone else seen similar behavior? If so, is my fix short lived and will it break again soon?

_Originally posted by @JV-HCA in https://github.com/Azure/Azure-Functions/issues/1291#issuecomment-906663857_