Configure Azure Function Access to Cosmos DB Secret Using Azure Key Vault

Learn how to configure an Azure Function App to securely retrieve an Azure Cosmos DB access key stored in Azure Key Vault using a system-assigned managed identity. This approach avoids storing secrets in code or configuration.

Prerequisites

• An Azure Key Vault with the Azure Cosmos DB access key stored as a secret
• An existing Azure Function App
• Permissions to assign RBAC roles on the Key Vault

Steps

1. Enable managed identity on Azure Function.

   1. Navigate to the Azure Function App in the Azure Portal.
   2. Select Identity from the left menu.

      

   3. Under System assigned, set Status to On.

      

   4. Save the configuration.

   Enabling a system-assigned managed identity creates an Azure-managed service principal for the Function App.

2. Grant Key Vault Access to Azure Function.

   1. Navigate to the Azure Key Vault.
   2. Select Access control (IAM).

      

   3. Click Add role assignment.

      

3. Configure the assignment as follows:

   • Role: Key Vault Secrets User

     

   • Assign access to: Managed identity

     

   • Member: Azure Function App

4. Save the role assignment.

   RBAC permission propagation may take several minutes.

After completing these steps, the Azure Function can securely retrieve the Cosmos DB access key from Azure Key Vault at runtime using its managed identity, without storing secrets in code or configuration.