Azure / Azure/azure-functions-host

Misconfigured Key Vault references cause silent errors in Az Function runtime

Open
#9,613 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 10h
Merged PRs (30d)
36

Description

#### Check for a solution in the Azure portal
For issues in production, please check for a solution to common issues in the Azure portal before opening a bug. In the Azure portal, navigate to your function app, select `Diagnose and solve problems` from the left, and view relevant dashboards before opening your issue.

#### Investigative information

Please provide the following:

- Timestamp: N/A
- Function App version: `4.27.2.21466`
- Function App name: N/A
- Function name(s) (as appropriate): N/A
- Invocation ID: N/A
- Region: West US

#### Repro steps

Provide the steps required to reproduce the problem:

1. Deploy one or more Functions into a Function App. The deployed function should access an environment variable (ex. `SAMPLE_ENV_VAR`).
2. Add a value in the Azure UI for the environment variable (ex. `SAMPLE_ENV_VAR`).
3. Confirm the Functions appear in the Function App in the Azure Portal UI and that the Functions can be executed.
4. Set the environment variable that the code accesses (ex. `SAMPLE_ENV_VAR`) to a KeyVault reference that the app does not have access to (ex. `@Microsoft.KeyVault(VaultName=my-keyvault-name;SecretName=my-secret-name)`)
5. Restart the function

#### Expected behavior

Provide a description of the expected behavior.

- The Function App throws an error which is visible in the logs showing a permission error when attempting to deference the Key Vault reference
- The Function App displays all Functions in the list of functions

#### Actual behavior

Provide a description of the actual behavior observed.

- The Function App's Functions disappear from the list
- The Function App does not throw a permissions error

#### Known workarounds

Provide a description of any known workarounds.

- Hardcode the Key Vault secret's value and restart the app. The app works just fine.

#### Related information

Provide any related information

* Programming language used: Node 18 - ESM

Contributor guide

Open the contributing guide

Research direction

No repository file or test is named. Start by reproducing the Azure Functions host behavior with an inaccessible Key Vault reference and inspect runtime logs during restart. Done means the permission error is visible and the app continues to display its Functions instead of silently removing them.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, node.js
Domain
authorization, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.