Overview
Prior to the Christmas break I was involved in writing some integrations that used a mixture of Logic Apps Standard and Function Apps. It was agreed as part of the architecture that user-assigned identities would be the best fit. As part of the implementation, I observed that the differences in configuration setup between system-assigned and user-assigned wasn’t widely understood. This article aims to show a brief run through of both.
Setup and Difference with System-Assigned
System-Assigned
The general process when using a System-Assigned identity is as follows:
-
Create a Key Vault Instance.
-
Create secrets required by the application.
-
Create the app resource (Logic App / Function App)
-
As part of the configuration, specify the identity as System Assigned.
-
Reference the key vault secret(s) in your App Settings.
-
-
Authorise the applications identity read access to key vault or specifically the key vaults secret.
The main points with System-Assigned setup is:
- The identity is tied to the created app resource and its life-cycle
- The resource cannot reference key vault secrets at the point of creation
- Authorisation to read the key vault secrets has not occurred at this point
- The identity cannot be associated with other resources
User-Assigned
The general process when using a User-Assigned identity is as follows:
-
Create a Key Vault instance
-
Create secrets required by the application(s)
-
Create the user-assigned identity
-
Authorise the user-assigned identity read access to key vault or specifically the key vaults secret.
-
Create the app resource (Logic App / Function App)
As part of the resource configuration
-
Specify the identity as user-assigned and reference the created identity in step 3
-
Specify the identity to be used for key vault reference operations by setting the
keyVaultReferenceIdentityproperty to the resource ID of the user-assigned identity -
Reference the key vault secret(s) in your App Settings.
-
The main points with User-Assigned setup is:
- The identity is managed outside the context of a resource and its life-cycle
- A resource that uses the identity can read secrets from keyvault at the point of creation
- Given that the authorisation has occurred prior to the resource creation.
- The identity can be associated with on or more resources
⚠️ Note One of the most common gotchas [user-assigned] is missing or forgetting to specify the identity to be used for key vault reference operations (keyVaultReferenceIdentity property - Step 5).
Hope this helps and have fun.