Azure / Azure/azure-functions-host

Problem with Azure Function and Managed Identity + VNET integration of storage: 500 Internal server error

Open
#9,190 4 comments 0 reactions 1 assignee Claimed by @brettsam View on GitHub
Needs: Attention :wave:
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

Hi,

We do have an App Service plan (EP1) in which we do have an http triggered Azure function, nodejs 18. Having VNET integration enabled. We also already have a UserAssigned managed identity configured with the necessary roles for the storage account where the function code resides in ("Storage Account Contributor", "Storage Blob Data Owner", and just in case it is needed "Storage Queue Data Contributor"), but that one is not yet completely in use - i.e. Connection strings to Storage Account are still having primary access keys. This does work.

As soon, as I switch the function to get rid of the connection string and rather provide `AzureWebJobs*__accountName` the invocation of the function produces a 500 Internal server without any further output or logs (already checked the Logs through logstream...)

Configuration changes looking then like this - code and others seemingly identical.

_Before - Working_
Config
![image](https://user-images.githubusercontent.com/2911492/228861433-dc7b1ccb-4c3a-42dd-b0ff-3eb1bd9230b0.png)
Produces output:
![image](https://user-images.githubusercontent.com/2911492/228864677-2a5c560d-d5ff-46c6-9a80-78ab4f6d0b92.png)

_After - Not working_
Config
![image](https://user-images.githubusercontent.com/2911492/228864572-ca366364-128f-44b2-991d-40403da2bca5.png)
500 Internal server error, no other output
![image](https://user-images.githubusercontent.com/2911492/228864828-364a182f-7b91-4dd6-a249-4f1d1fbd4620.png)

In #8337 it was mentioned, VNET and managed identity together may not be supported - is that true? I didn't find any current/official documentation claiming this...

Invocations in the non-working state (with that 500 Internal server error) do not even appear in the diagram on the start page of the app (there is very low volume of traffic to this function app, so it's possible to see individual executions).

#### Investigative information

Please provide the following:

- Timestamp: Thu, 30 Mar 2023 14:24:20 GMT
- Function App version: Linux - NODE|18 (is this what you need?)
- Function App name: sandbox-rube-fa-basicc-markant
- Function name(s) (as appropriate): AzureAlertHttpTrigger
- Invocation ID: None available as far as I know, but maybe the following help from my request headers:
request-context: appId=cid-v1:5443f5a3-02cd-43d3-90d6-1942e07580a1
request-id: |oB2FR.Bs44k
- Region: West Europe

#### Repro steps

Provide the steps required to reproduce the problem:

1. Execute function in the mentioned configuration using the sample of common alert schema as POST body (or just an empty JSON object `{}`) https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-common-schema#sample-alert-payload

#### Expected behavior
200 status code at the end or at least some error output
Provide a description of the expected behavior.

#### Actual behavior
Provide a description of the actual behavior observed.

500 internal server error without error output.

Another sample output:
![image](https://user-images.githubusercontent.com/2911492/228872397-047f8d1b-0b6d-47a8-bd51-dc419fa5b4dd.png)

-> The only response headers there are the following (Server=Kestrel + Date + 0 Content-Length):

#### Known workarounds

Provide a description of any known workarounds.

#### Related information

Provide any related information

* Programming language used : nodejs18
* Links to source : closed
* Bindings used : none afaik

Please note, we are using terraform (azurerm_linux_function_app) to provision this function app and the only change from making it work to not work is replacing this line

```
storage_account_access_key = var.storage_account_primary_access_key
```

with that line:
```
storage_uses_managed_identity = true
```

which in effect switches the mentioned configuration.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.