Key Vault with azure functions python

readme.md

A simple example - accessing Key Vault from a python http triggered function. Originally wanted to do this with MSI, but sadly, no MSI support just yet. When MSI is available it should look something like this. I don't do much python so if looking at this makes your insides hurt, please let me know.

to publish:

because certain dependencies are binary, you have to build in a docker container - --build-native-deps does this for you during publish

to create a service principal for rbac assignment to KV secrets, use az ad sp create-for-rbac --name 'a-recognizable-name' --skip-assignment

to publish from local, login to azure cli az login and set your subscription to the one containing your function, then

func azure functionapp publish <your function app> --build-native-deps

init-manual-service-principal.py

import logging
import azure.functions as func

from azure.keyvault import KeyVaultClient, KeyVaultAuthentication
from azure.common.credentials import ServicePrincipalCredentials
# see https://docs.microsoft.com/en-us/python/api/overview/azure/key-vault?view=azure-python

def auth_callback(server, resource, scope):
    credentials = ServicePrincipalCredentials(
        client_id = '<CLIENT ID>',
        secret = '<CLIENT SECRET>', 
        tenant = '<TENANT GUID>',
        resource = "https://vault.azure.net"
    )
    token = credentials.token
    return token['token_type'], token['access_token']

client = KeyVaultClient(KeyVaultAuthentication(auth_callback))

def main(req: func.HttpRequest) -> func.HttpResponse:
    logging.info('Python HTTP trigger function processed a request.')
    secret_bundle = client.get_secret("https://<YOUR VAULT NAME>.vault.azure.net/", "<SECRET NAME>", "<SECRET VERSION>")
    return func.HttpResponse(f"{secret_bundle.value}!")

init-with-msi.py

import logging
import azure.functions as func
from azure.keyvault import KeyVaultClient
from msrestazure.azure_active_directory import MSIAuthentication, ServicePrincipalCredentials

credentials = MSIAuthentication(
    resource='https://vault.azure.net'
)
client = KeyVaultClient(
    credentials
)

def main(req: func.HttpRequest) -> func.HttpResponse:
    logging.info('Python HTTP trigger function processed a request.')
    secret_bundle = client.get_secret("https://<YOUR VAULT NAME>.vault.azure.net/", "<SECRET NAME>", "<SECRET VERSION>")
    return func.HttpResponse(f"{secret_bundle.value}!")

requirements.txt

adal==1.2.1
asn1crypto==0.24.0
astroid==2.1.0
azure-common==1.1.17
azure-functions==1.0.0a5
azure-functions-worker==1.0.0a6
azure-keyvault==1.1.0
azure-nspkg==3.0.2
certifi==2018.11.29
cffi==1.11.5
chardet==3.0.4
colorama==0.4.1
cryptography==2.5
grpcio==1.14.2
grpcio-tools==1.14.2
idna==2.8
isodate==0.6.0
isort==4.3.4
lazy-object-proxy==1.3.1
mccabe==0.6.1
msrest==0.6.4
msrestazure==0.6.0
oauthlib==3.0.1
protobuf==3.6.1
pycparser==2.19
PyJWT==1.7.1
pylint==2.2.2
python-dateutil==2.7.5
requests==2.21.0
requests-oauthlib==1.2.0
six==1.12.0
typed-ast==1.2.0
urllib3==1.24.1
wrapt==1.11.1