I can't seem to find clear documentation on how to set a System-assigned Managed Identity-based connection for my Queue-triggered Azure Function.
Steps taken:
- Enabled System-assigned Managed Identity (SAMI) for the Azure Function
- On the Queue Storage Account, granted the SAMI
Storage Queue Data ReaderandStorage Queue Data Message ProcessorRoles per this doc. - Ensured the Extension Version is
5.0.0or later
"extensionBundle": {"id": "Microsoft.Azure.Functions.ExtensionBundle","version": "[4.*, 5.0.0)" }- Added a
connectionvalue to the Function'sfunction.jsonfile:
{"scriptFile": "__init__.py","bindings": [ {"name": "msg","type": "queueTrigger","direction": "in","queueName": "my-q","connection": "QUEUE_CONN" } ]}- Added a
QUEUE_CONN__queueServiceUriapp setting to the Function'slocal.settings.jsonfile per this SO question, which references this doc.
{"IsEncrypted": false,"Values": {"FUNCTIONS_WORKER_RUNTIME": "python","AzureWebJobsStorage": "UseDevelopmentStorage=true","QUEUE_CONN__queueServiceUri": "https://<my-q-storage>.queue.core.windows.net" }}- After
func azure functionapp publish <my-function> --publish-local-settings, and writing the appropriate setting to Azure...the function will not trigger when adding a new queue.
- I also tried adding
QUEUE_CONN__managedIdentityResourceIdper this (contradicting?) doc. But this didn't seem to trigger the Function upon adding a queue.
I'd really like to get away from dealing with a Key Vault secret when all other connections within the function rely on SAMI auth.
Any ideas?