如何在Azure函数应用中读取带Key Vault引用的App Configuration值？

核心问题原因 #

直接使用ConfigurationClient获取配置项时，返回的是Key Vault引用的原始URI，而非自动解析后的实际密钥值。官方推荐通过IConfiguration结合Azure App Configuration的Key Vault整合功能，实现引用的自动解析。

解决方案1：使用IConfiguration自动解析（推荐） #

步骤1：修改ConfigureAppConfiguration，添加Key Vault支持 #

在ConfigureAppConfiguration中配置UseAzureKeyVault，让App Configuration自动处理Key Vault引用，需借助DefaultAzureCredential获取访问权限：

using Azure.Identity;

public override void ConfigureAppConfiguration(IFunctionsConfigurationBuilder builder)
{
    var connectionString = Environment.GetEnvironmentVariable("ConnectionString");
    var credential = new DefaultAzureCredential();

    builder.ConfigurationBuilder.AddAzureAppConfiguration(options =>
    {
        options.Connect(connectionString)
               .Select("FunctionApp:*")
               .ConfigureRefresh(refreshOptions =>
               {
                   refreshOptions.Register("FunctionApp:Replication:Regions", refreshAll: true);
               })
               // 启用Key Vault引用自动解析
               .UseAzureKeyVault(credential);
    });
}

步骤2：通过IConfiguration获取解析后的实际值 #

修改StorageService，注入IConfiguration替代ConfigurationClient，直接读取解析后的密钥值：

private readonly IConfiguration _configuration;
private readonly IConfigurationRefresher _configurationRefresher;

public StorageService(IConfiguration configuration, IConfigurationRefresherProvider refresherProvider)
{
    _configuration = configuration;
    _configurationRefresher = refresherProvider.Refreshers.First();
}

public async Task<List<string>> GetRegionSecretsAsync()
{
    // 触发配置刷新（按需调用）
    await _configurationRefresher.TryRefreshAsync();

    // 获取所有区域对应的密钥值
    var regionSecrets = new List<string>();
    var regionSection = _configuration.GetSection("FunctionApp:Replication:Regions");
    
    foreach (var childSetting in regionSection.GetChildren())
    {
        regionSecrets.Add(childSetting.Value);
    }

    return regionSecrets;
}

权限配置 #

确保函数应用的托管身份（或服务主体）拥有以下权限：

• Azure App Configuration的读取权限
• Key Vault的**机密读取（Secret Get）**权限

解决方案2：手动解析Key Vault引用（不推荐） #

若必须使用ConfigurationClient，可手动解析每个配置项的URI，调用Key Vault API获取实际值：

步骤1：定义Key Vault引用模型 #

using System.Text.Json.Serialization;

public class KeyVaultReference
{
    [JsonPropertyName("uri")]
    public Uri Uri { get; set; }
}

步骤2：手动解析并获取密钥 #

using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using System.Text.Json;

private readonly ConfigurationClient _client;
private readonly IConfigurationRefresher _configurationRefresher;
private readonly SecretClient _secretClient;

public StorageService(ConfigurationClient client, IConfigurationRefresherProvider refresherProvider)
{
    _client = client;
    _configurationRefresher = refresherProvider.Refreshers.First();
    // 初始化SecretClient
    var credential = new DefaultAzureCredential();
    _secretClient = new SecretClient(new Uri("https://appconfigurationkeyvalut.vault.azure.net/"), credential);
}

public async Task<List<string>> GetRegionSecretsAsync()
{
    // 触发配置刷新
    await _configurationRefresher.TryRefreshAsync();

    SettingSelector settingSelector = new SettingSelector()
    {
        KeyFilter = "FunctionApp:Replication:Regions"
    };

    var settings = _client.GetConfigurationSettings(settingSelector).ToList();
    var regionSecrets = new List<string>();

    foreach (var setting in settings)
    {
        // 解析Key Vault引用的JSON
        var kvRef = JsonSerializer.Deserialize<KeyVaultReference>(setting.Value);
        // 获取密钥值
        var secret = await _secretClient.GetSecretAsync(kvRef.Uri.AbsolutePath.TrimStart('/'));
        regionSecrets.Add(secret.Value.Value);
    }

    return regionSecrets;
}

内容的提问来源于stack exchange，提问作者Ali Hasan