A larch-resin pot Function has Key Vault references configured but still receives 403 when resolving secrets. What is the likely missing piece?
Select an answer to reveal the explanation.
Short Explanation
References are only half the story—the Function’s identity still needs secrets get on the vault. A 403 usually means “badge missing,” not “wrong SKU.” Prefer RBAC (current default) or an access-policy get on older vaults.
Full Explanation
Key Vault references tell the platform where to read a secret; they do not by themselves authorize the read. The larch-resin pot Function's managed identity or other principal must be granted secrets-get through Azure RBAC (for example Key Vault Secrets User) or through an access policy on older permission models. A 403 while resolving references almost always means the badge exists but lacks the vault data-plane permission.
Replacing the Function with a public static website so Key Vault allows anonymous get fails because Key Vault does not hand secrets to anonymous internet callers as a design goal. Removing the managed identity so the vault trusts unsigned requests fails the opposite direction—without a principal there is nothing to authorize. Moving secrets into Application Insights log attributes to avoid authorization leaks credentials into telemetry and abandons Key Vault controls.
Exam caveat: know which permission model the vault uses (RBAC versus access policy); granting the wrong model's permission looks like you assigned a role while 403 continues. Operational check: open the Function's identity object ID, confirm a secrets-get role assignment or access-policy entry on the vault, retry reference resolution, and compare a deliberate role removal that reproduces the 403 for the municipal runbook.