从功能应用程序读取Azure密钥库机密

Question

这个Python脚本被部署为从Azure函数应用程序运行在Linux消费计划上，这个脚本被期望从Azure密钥库中读取机密。

除了代码部署之外，还进行了以下配置

null

import azure.functions as func
import os
from azure.identity import ManagedIdentityCredential
from azure.keyvault.secrets import SecretClient

def main(mytimer: func.TimerRequest) -> None:
    identity = ManagedIdentityCredential()
    secretClient = SecretClient(vault_url="https://vault-name.vault.azure.net/", credential=identity)
    secret = secretClient.get_secret('secret-name').
    print (secret.value)

azure-functions
azure-keyvault-secrets
azure-identity

Result: Failure Exception: HttpResponseError: (Forbidden) The user, group or application 'appid=6fb8XXXX-bba6-4fa7-8a76-a193XXXXd8d7;oid=e4c1XXXX-602d-44b7-a2e6-f646XXXXe360;iss=https://sts.windows.net/320bXXXX-7580-46ef-a61a-7f3fXXXXbe8f/' does not have secrets get permission on key vault 'vault-name;location=northcentralus'. 
For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287 Stack: 

File "/azure-functions-host/workers/python/3.7/LINUX/X64/azure_functions_worker/dispatcher.py", 
line 315, in _handle__invocation_request self.__run_sync_func, invocation_id, fi.func, args) File "/usr/local/lib/python3.7/concurrent/futures/thread.py", 
line 57, in run result = self.fn(*self.args, **self.kwargs) File "/azure-functions-host/workers/python/3.7/LINUX/X64/azure_functions_worker/dispatcher.py", 
line 434, in __run_sync_func return func(**params) File "/home/site/wwwroot/FunctionAppName/__init__.py", 
line 14, in main secret = secretClient.get_secret('secret-name') File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/core/tracing/decorator.py", 
line 83, in wrapper_use_tracer return func(*args, **kwargs) File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/keyvault/secrets/_client.py", 
line 71, in get_secret **kwargs File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/keyvault/secrets/_shared/_generated/v7_0/operations/_key_vault_client_operations.py", 
line 1625, in get_secret map_error(status_code=response.status_code, response=response, error_map=error_map) File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/core/exceptions.py", 
line 102, in map_error raise error

此错误说明应用程序没有密钥库上的机密获取权限，但如上所述，将角色分配给在密钥库上具有阅读器角色的功能应用程序。

配置中可能出现的问题是什么？如何缓解？

Answer 1

为了读取机密，您实际上需要创建一个访问策略，并添加与Azure函数相关的托管标识：