Reading a secret from Azure Key Vault takes a long time

Question

As the title says I'm currently having an issue where the following piece of code take 20+ seconds to execute.

var azureServiceTokenProvider = new AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(
             new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
var secret = await keyVaultClient.GetSecretAsync(vaultBaseUrl, secretName).ConfigureAwait(false);

The Secret is read eventually but I feel this is an excessive amount of time to wait. I have yet to find anyone with a similar issue.

First time using Key Vault, am I possibly not accessing it correctly?

I have a possibly related issue posted here: https://stackoverflow.com/questions/53487888/apparent-delay-in-azure-keyvault-access — wayfarer, Nov 26 '18 at 19:39

score 3 · Answer 1 · answered Sep 27 '19 at 14:31

3

I had the same issue (on my development machine) and the reason was, that AzureServiceTokenProvider seems first to try a local url's that time out which is probably the better setting when running on Azure but not for local development.

The solution for me was to set the environment variable AzureServicesAuthConnectionString to the value RunAs=Developer; DeveloperTool=VisualStudio on my dev machine.

See also this github issue https://github.com/Azure/azure-sdk-for-net/issues/4645

answered Sep 27 '19 at 14:31

martinoss

5,268
2
45
53

1

I had to use `DeveloperTool=AzureCli` instead of `DeveloperTool=VisualStudio`, as explained [here](https://stackoverflow.com/a/61166447/543814). – Timo Oct 19 '20 at 15:26
This worked for me. Thanks! Huge. Saves me 55s. – Pangamma Jan 11 '21 at 21:11

score 0 · Answer 2 · answered Sep 19 '18 at 11:07

0

Try starting the stopwatch after you retrieve your access token from AAD and ending it once you retrieve the secret. I suspect the delay is during the retrieval of the token.

Personally I found it was quicker to just get the token yourself when I created an app that used Azure APIs.

answered Sep 19 '18 at 11:07

Zak

48
5

Yeah same thing, it's the GetSecretAsync that seems to be the culprit. – M0rty Sep 19 '18 at 11:14

score 0 · Answer 3 · answered Sep 20 '18 at 05:17

0

The SLA for Azure Key Vault Service is supposed to be much better than what you're observing here. I mention it here because if all else fails, you could take this up with Microsoft Support and they should be able to help. SLA for Key Vault

We guarantee that we will process Key Vault transactions within 5 seconds at least 99.9% of the time.
Check which region did you create your Key Vault in? Is your application (where you're accessing it from) in a completely different region by any chance?

answered Sep 20 '18 at 05:17

Rohit Saigal

9,317
2
20
32

Thanks for the SLA info. Yes both Key Vault and App are in the same location. – M0rty Sep 20 '18 at 05:24
Are you running this from inside an Azure Function or App Service? – Rohit Saigal Sep 20 '18 at 05:29
I have an Azure Function that references a .NET Framework Class library which gets the secret. – M0rty Sep 20 '18 at 05:33

Reading a secret from Azure Key Vault takes a long time

3 Answers3