Calling Function APP using URL and Function Key from Azure API Management

This post was originally published here

In this post I will talk about how we can access function app from APIM using url & function key. There was a requirement were we don’t want to add function app as an Azure Resource into the APIM, instead access via URL and function key, storing and retrieving the key from Key Vault.

So what I did.

Created a Resource Deploy project to create and store function key in Key Vault.

azuredeploy.parameters.json

{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"keyVaultName": {
"value": "#{KeyVaultName}"
},
"functionAppName": {
"value": "fapp-#{EnvironmentPrefix}-product-reference"
},
"functionAppResourceGroup": {
"value": "#{AzureDeploymentResourceGroup}"
}
}
}

azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "keyVaultName": {
      "type": "string"
    },
    "functionAppName": {
      "type": "string"
    },
    "functionAppResourceGroup": {
      "type": "string"
    }    
  },
  "variables": {
    "functionAppId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', parameters('functionAppResourceGroup'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'))]",
    "KeyName": "[concat(parameters('functionAppName'),'-functionkey')]"
  },
  "resources": [
    {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "name": "[concat(parameters('keyVaultName'),'/', variables('KeyName'))]",
      "apiVersion": "2015-06-01",
      "properties": {
        "contentType": "text/plain",
        "value": "[listkeys(concat(variables('functionAppId'), '/host/default/'),'2016-08-01').functionKeys.default]"
      },
      "dependsOn": []
    }

  ],
  "outputs": {
    "functionAppId": {
      "type": "string",
      "value": "[variables('functionAppId')]"
    }
  }
}

Now created Resource deploy Project for APIM .

azuredeploy.parameters.json

"FunctionKey": {
  "reference": {
    "keyVault": {
      "id": "#{AzureKeyVaultID}"
    },
    "secretName": "fapp-#{EnvironmentPrefix}-product-paymentreference-functionkey"
  }
},
"FunctionKeyDR": {
  "reference": {
    "keyVault": {
      "id": "#{AzureKeyVaultID}"
    },
    "secretName": "fapp-#{SecondaryEnvironmentPrefixFapp}-product-paymentreference-functionkey"
  }

Below is what we need to add as a back-end service in the azuredeploy.json

 {
      "type": "Microsoft.ApiManagement/service/backends",
      "apiVersion": "2019-01-01",
      "name": "[concat(parameters('ApimServiceName'), '/', variables('nVKeyPrimaryHostnameCreate'))]",
      "dependsOn": [
        "[resourceId('Microsoft.ApiManagement/service/apis', parameters('ApimServiceName'), parameters('apiname'))]"
      ],
      "properties": {
        "url": "[variables('nVValuePrimaryHostnameCreate')]",
        "protocol": "http",
        "resourceId": "[concat('https://management.azure.com/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/sites/', parameters('backendid'))]",
        "credentials": {
          "header": {
            "x-functions-key": [
              "[parameters('FunctionKey')]"
            ]
          }
        }
      }
    },
{
      "type": "Microsoft.ApiManagement/service/backends",
      "apiVersion": "2019-01-01",
      "name": "[concat(parameters('ApimServiceName'), '/', variables('nVKeySecondaryHostnameValidatePRN'))]",
      "dependsOn": [
        "[resourceId('Microsoft.ApiManagement/service/apis', parameters('ApimServiceName'), parameters('apiname'))]"
      ],
      "properties": {
        "url": "[variables('nVValueSecondaryHostnameCreate')]",
        "protocol": "http",
        "resourceId": "[concat('https://management.azure.com/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/sites/', parameters('backendid'))]",
        "credentials": {
          "header": {
            "x-functions-key": [
              "[parameters('FunctionKeyDR')]"
            ]
          }
        }
      }
    },