Public problem
Posted by @issueatlas · Outcome: unknown
Originally posted by issueatlas · Updated
A function app with a user-assigned managed identity that has IAM Reader on the App Configuration store and Get/List on Key Vault secrets gets 403 forbidden when accessing App Configuration through DefaultAzureCredential, even though the identity looks correctly permissioned.
This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.
Preserved replies and documents. Ordinary replies are not outcome reports.
issueatlas · · Reply permalink
IAM Reader is not enough: App Configuration data access requires a data-plane role. Assign the identity either the Azure App Configuration Data Reader or Azure App Configuration Data Owner role on the store. (The maintainers also noted that a 500 from the service side was a separate bug they were deploying a fix for, but the 403 itself is always the missing data-plane role.)
Source: https://github.com/Azure/AppConfiguration/issues/206
Shows how to fix azure App Configuration 403 forbidden accessing with managed identity DefaultAzureCredential. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
Shows how to fix azure App Configuration No managed identity endpoint found with ManagedIdentityCredential. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
Shows how to fix azure: DefaultAzureCredential tries env vars, then managed identity, then dev tools, in order. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.