Azure / Azure/azure-functions-host
Problem with Azure Function and Managed Identity + VNET integration of storage: 500 Internal server error
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
Hi,
We do have an App Service plan (EP1) in which we do have an http triggered Azure function, nodejs 18. Having VNET integration enabled. We also already have a UserAssigned managed identity configured with the necessary roles for the storage account where the function code resides in ("Storage Account Contributor", "Storage Blob Data Owner", and just in case it is needed "Storage Queue Data Contributor"), but that one is not yet completely in use - i.e. Connection strings to Storage Account are still having primary access keys. This does work.
As soon, as I switch the function to get rid of the connection string and rather provide `AzureWebJobs*__accountName` the invocation of the function produces a 500 Internal server without any further output or logs (already checked the Logs through logstream...)
Configuration changes looking then like this - code and others seemingly identical.
_Before - Working_
Config

Produces output:

_After - Not working_
Config

500 Internal server error, no other output

In #8337 it was mentioned, VNET and managed identity together may not be supported - is that true? I didn't find any current/official documentation claiming this...
Invocations in the non-working state (with that 500 Internal server error) do not even appear in the diagram on the start page of the app (there is very low volume of traffic to this function app, so it's possible to see individual executions).
#### Investigative information
Please provide the following:
- Timestamp: Thu, 30 Mar 2023 14:24:20 GMT
- Function App version: Linux - NODE|18 (is this what you need?)
- Function App name: sandbox-rube-fa-basicc-markant
- Function name(s) (as appropriate): AzureAlertHttpTrigger
- Invocation ID: None available as far as I know, but maybe the following help from my request headers:
request-context: appId=cid-v1:5443f5a3-02cd-43d3-90d6-1942e07580a1
request-id: |oB2FR.Bs44k
- Region: West Europe
#### Repro steps
Provide the steps required to reproduce the problem:
1. Execute function in the mentioned configuration using the sample of common alert schema as POST body (or just an empty JSON object `{}`) https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-common-schema#sample-alert-payload
#### Expected behavior
200 status code at the end or at least some error output
Provide a description of the expected behavior.
#### Actual behavior
Provide a description of the actual behavior observed.
500 internal server error without error output.
Another sample output:

-> The only response headers there are the following (Server=Kestrel + Date + 0 Content-Length):
#### Known workarounds
Provide a description of any known workarounds.
#### Related information
Provide any related information
* Programming language used : nodejs18
* Links to source : closed
* Bindings used : none afaik
Please note, we are using terraform (azurerm_linux_function_app) to provision this function app and the only change from making it work to not work is replacing this line
```
storage_account_access_key = var.storage_account_primary_access_key
```
with that line:
```
storage_uses_managed_identity = true
```
which in effect switches the mentioned configuration.
Contributor guide
Assessment
This issue has not been assessed yet.