Names of _master and default secret in keyvault are not unique so function apps cannot share same keyvault
- Dominant language
- PowerShell
- Stars
- 1.1k
- Forks
- 215
- Avg merge
- 4h 2m
- Merged PRs (30d)
- 1
Description
Function App name: doesn't matter
Tools used: irrelevant
New V4 app
We are trying to use multiple function apps for some data integration work and are trying to secure their configuration. So we are trying to follow the recommendations from here: https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4
We have managed to instantiate a function app and integrate with key-vault using a user-managed identity. We can see that the function app successfully creates two secrets _master and default. The problem is the names of these secrets are not unique: 'host--functionKey--default' and 'host--masterKey--master' (see screnshot) which means instantiating the second function app creates a broken function app with no keys or ability to create new ones: the option to create is greyed out but after a long wait I can initiate key creation which fails with "Encountered an error (InternalServerError) from host runtime." error.
The fact that default keys aren't uniquely named will also create an issue when one deletes the function app and creates a new one pointing to the same keyvault.
Also before you suggest we are not able to adopt the model where we allocate a dedicated keyvault instance to a function app.



Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.