Azure Key Vault not allow access via private endpoint connection

Question

I've a azure web service (linux) and azure key vault.

i configure two private endpoint , to allow the communication between Azure Key Vault and Azure web app.

i set all permissions in key vault's access policy , i ve already added identiy managed in the azure web app and the two endpoint are in the same virtual network, but the app is unable to read the key vault reference

any idea to resolve that ?

EDIT :

The access is allowed from private endpoint and selected networks

i don't want to put the public ip address of my web app in the firewall

i added the vnet in the key vault

I think that the firewall is blocking requests. When you enable the firewall, it blocks everything except the whitelisted address, including internal IPs. With private endpoint, the KV should have a private IP for internal use. Turn off the firewall and test to see if it works. If it does, is the Key Vault also still accessible from the public? I think it should not be accessible once the private endpoint is enabled. If it not accessible from the public, but it is from the linux app service, you're configured properly. — Matt Small
– Matt Small, Commented May 18, 2021 at 18:53

Nancy Xiong · Accepted Answer · 2021-05-19 08:06:43Z

8

To allow your azure app service to access the Azure key vault with a private endpoint, you have to do the following steps:

Using regional VNet Integration enables your app to access a private endpoint in your integrated virtual network.
Establishing a private link connection to an existing key vault.
Validating that the private link connection works. From your Azure app service console or kudu portal, you can validate that your application is connecting to your key vault over a private IP address and that they have the correct private DNS zone integration.
Add access policy of key vault for your Azure web app.

In this case, you can enable the firewall of the key vault via selecting the checkbox of the private endpoint and selected networks when you use the private link, read Key Vault Firewall Enabled (Private Link).

Please note that when you use Key Vault references.

Currently, Key Vault references won't work if your key vault is secured with service endpoints. To connect to a key vault by using virtual network integration, you need to call Key Vault in your application code.

You could read these wonderful blog1 and blog2 for more details.

answered May 19, 2021 at 8:06

Nancy Xiong

28.3k3 gold badges22 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

13 Comments

Youssef CH Over a year ago

thanks for you repley , i already establish a private link connection and validate them using this tutorial : learn.microsoft.com/en-us/azure/key-vault/general/… , but i want to know why i should use a regional vnet

Youssef CH Over a year ago

also , i have a private endpoint , i think i can use reference

Nancy Xiong Over a year ago

By default, Azure web app access from the Internet, if you want to access key vault with exposing the private endpoint of key vault only and don't need to put the public ip address of web app in the firewall, you need to gain access to the VNet from your web app. This required a vnet integration.

Youssef CH Over a year ago

Thanks for you reply , i have a question , please : i ve activate a private endpoint connection in the web app , also a private endpoint in key vault (the same vnet) , i already test the key vault's private endpoint usong nslookup from a vm in the same network , so , i should use library to access key vault ?

Nancy Xiong Over a year ago

It should be, anyway, you should use that Azure key vault URL because its FQDN will be resolved to the private IP address of the private endpoint. This will identify if you are accessing from a private VNet instead of from the public internet.

|

Collectives™ on Stack Overflow

Azure Key Vault not allow access via private endpoint connection

1 Answer 1

13 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

13 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related