Azure function for rotation of Storage Account keys with Key Vault
MIT License
Functions regenerate individual key (alternating between two keys) in Storage Account and add regenerated key to Key Vault as new version of the same secret.
This project framework provides the following features:
Rotation function for StorageAccount key triggered by Event Grid (AKVStorageAccountRotation)
Rotation function for Storage Account key triggered by HTTP call (AKVStorageAccountRotationHttp)
ARM template for function deployment with secret deployment (optional)
ARM template for adding storage account key to existing function with secret deployment (optional)
Functions require following information stored in secret as tags:
You can create new secret with above tags and Storage Account key as value or add those tags to existing secret with Storage Account key. For automated rotation expiry date will also be required - key vault triggers 'SecretNearExpiry' event 30 days before expiry.
There are two available functions performing rotation:
Functions are using Function App identity to access Key Vault and existing secret "CredentialId" tag with storage account key id (key1/key2) and "ProviderAddress" with Storage Account Resource Id.
ARM templates available:
You can find example for Storage Account rotation in tutorial below: Automate the rotation of a secret for resources that have two sets of authentication credentials
Youtube: https://youtu.be/qcdVbXJ7e-4
This project was generated using this template. You can find instructions here