How can I get Azure Functions keys from Bicep

Question

I have the following code to create an Azure Function App with Bicep lang

resource webSite 'Microsoft.Web/sites@2022-03-01' = {
  name: 'xxxxxx'
  location: resourceGroup().location
  kind: 'functionapp'
  properties: {
    serverFarmId: 'zzzzzz'
    siteConfig: {     
      appSettings: [
        // some values
      ]
    }
  }
}

Then I need to get the host keys like 'master' or 'default' key

I tried some options like

resource functionApp 'Microsoft.Web/sites/functions@2022-03-01' existing = { name: 'xxxxxx' }

output key string = functionApp.listkeys().properties.masterKey

or

output key string = listKeys(resourceId('Microsoft.Web/sites/host', 'xxxxxx', 'default'), '2022-03-01').masterKey

But I allways receive an error from Azure with this message Encountered an error (BadGateway) from host runtime.

There are a way to get the keys easily?

To get the keys do I need to deploy a function inside my Function App?

Answer 1

To get the Azure functionApp/function keys, I tried the below approaches and it worked for me.

1. Using Az CLI:

Use below command to retrieve the function app keys and their secret values in Azure Bash:

az functionapp keys list -g <resourcegroup> -n <functionappname>

Output:

Use below command to retrieve the function keys and their secret values in Azure Bash:

az functionapp function keys list -g <resourcegroup> -n <functionappname> --function-name <functionname>

Output:

2. Bicep code:

I also tried by creating a bicep configuration file in my environment with the below script as follows:

param  functionApp  string
resource  appKeys  'Microsoft.Web/sites/functions@2022-03-01'  existing ={
name: functionApp
}
output key object = listkeys(concat(resourceId('Microsoft.Web/sites', functionApp), '/host/default/'),'2021-02-01').masterKey

Build succeeded by using below command:

bicep build < filename >:

Note: But in bicep, output should not have secret values according to the linter rule code as detailed in MSDoc.

Alternatively, you can refer SO given by @Shui shengbao to list the function keys with ARM json template.

Answer 2

The error is indicative of a storage account access issue.

Please check your appsettings. You can also see if you can show the keys using Azure Portal.

• AzureWebJobsStorage should be a valid connection string and the account accessible (VNETs etc.)
• If WEBSITE_RUN_FROM_PACKAGE is set, make sure your function code is also deployed correctly and working

A valid bicep code to get the keys:

output key string = listkeys('${functionApp.id}/host/default', '2022-03-01').masterKey

Note that listkeys('${functionApp.id}/host/xxxx/default' ... is incorrect. You don't need xxxx there. If you need the key of a slot you can use output key2 string = listkeys('${functionApp.id}/slots/${slotname}/host/default', ...