[Python] Azure function cannot access Keyvault in Azure (Forbidden, not authorized, not...

I have an Azure function fetching secrets from a KeyVault. Both in same resoucegroup, same region. For testing purposes, public access is allowed for whitelisted IPs. Testing locally works with whitelisting my IP address, Azure function can access Keyvault.

Running in Azure does not work, with the following error in function logs:

An error occurred: (Forbidden) Client address is not authorized and caller is not a trusted service. Client address: xx.xxx.xxx.xx
​

Azure function is configured as follows:

• System assigned identity
• Function object ID added as Key Vault Secrets User (and later even Key Vault Secrets Admin for testing purpose)

Keyvault is configured as follows:

• Access config: Azure RBAC
• Networking: Public access from selected networks, no network security perimeter, whitelisted IP addresses:
  • my local one
  • all IP addresses of the Azure function + all IP addresses in the log error messages

Code snippet

# Use Managed Identity to authenticate
credential = DefaultAzureCredential()

# Create a Key Vault client
client = SecretClient(vault_url=key_vault_url, credential=credential)

# Retrieve mySecret from Key Vault
secret_name = "mySecret"
retrieved_secret = client.get_secret(secret_name)

Continue reading...