Azure Function with QueueTrigger: is it possible to configure only the Storage Account Url and access the Queue using a Managed Identity?

Question

I've defined this function:

[FunctionName("My_QueueTrigger")]
public Task RunAsync([QueueTrigger("my-queue-name", Connection = "AzureWebJobsStorage")] string text)
{
  // code here...
}

And the AzureWebJobsStorage (on Azure) contains the following: "DefaultEndpointsProtocol=https;AccountName=my-storage-account;AccountKey=mykey;EndpointSuffix=core.windows.net"

(Note that for local development, the value is "UseDevelopmentStorage=true".)

My question is of it's also possible to just define the Storage Account name here like "https://my-storage-account.queue.core.windows.net" and use the Managed Identity (which has Processor permissions) from the Azure Function to read/trigger on messages.

Answer 1

I think your requirement is impossible.

The underlying code connected to the Storage has been encapsulated in the WebJob package, which is included as a member package in the expansion package of the entire function. You have to modify the underlying code to achieve the functions you want.

Check the source code of queuetrigger attribute:

using System;
using System.Diagnostics;
using Microsoft.Azure.WebJobs.Description;

namespace Microsoft.Azure.WebJobs
{
    /// <summary>
    /// Attribute used to bind a parameter to an Azure Queue message, causing the function to run when a
    /// message is enqueued.
    /// </summary>
    /// <remarks>
    /// The method parameter type can be one of the following:
    /// <list type="bullet">
    /// <item><description>CloudQueueMessage</description></item>
    /// <item><description><see cref="string"/></description></item>
    /// <item><description><see cref="T:byte[]"/></description></item>
    /// <item><description>A user-defined type (serialized as JSON)</description></item>
    /// </list>
    /// </remarks>
    [AttributeUsage(AttributeTargets.Parameter)]
    [DebuggerDisplay("{QueueName,nq}")]
    [ConnectionProvider(typeof(StorageAccountAttribute))]
    [Binding]
    public sealed class QueueTriggerAttribute : Attribute, IConnectionProvider
    {
        private readonly string _queueName;

        /// <summary>Initializes a new instance of the <see cref="QueueTriggerAttribute"/> class.</summary>
        /// <param name="queueName">The name of the queue to which to bind.</param>
        public QueueTriggerAttribute(string queueName)
        {
            _queueName = queueName;
        }

        /// <summary>Gets the name of the queue to which to bind.</summary>
        public string QueueName
        {
            get { return _queueName; }
        }

        /// <summary>
        /// Gets or sets the app setting name that contains the Azure Storage connection string.
        /// </summary>
        public string Connection { get; set; }
    }
}

You can find the source code, it tells us we need to give the connection string instead of the storage url.

Download the source code of webjobs package, and check the source code of queuetrigger, you will find that the source code does not implement that you want. You cannot tell the function that you want to use MSI, and it does not provide you with any way to use this feature.

In short, source code cannot realize your ideas. Unless you modify the underlying implementation of the source code, recompile and import the package, it is impossible.

Answer 2

I managed to do it this way:

*.csproj

<PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Storage.Queues" Version="5.2.0" />

*.cs

public static void MyFunction([QueueTrigger("my-queue", Connection = "QueueStorage")] MyModel myModel, FunctionContext context)

appsettings.json

"AzureWebJobsQueueStorage__queueServiceUri": "https://<accountname>.queue.core.windows.net"