Advice on how to get automated pgp encryption via azure function running

Question

i am trying to use this repo (https://github.com/lfalck/AzureFunctionsPGPEncrypt/) for a Blob Trigger Azure Function. When a new blob is detected, it should take that blob, encrypt it and store it in the same Blob Container but different Subfolder. This should run completely in Azure during night, when there are some .csv files arriving in my blob storage.

I stored the public Key in Key Vault. First I took the .asc file and used powershell to convert it to Base64 .txt file. Then i copied the content of the .txt file and stored it in a secret, named it pgp-public-key.

Thats where i am now. Does someone have a running solution and can give me advice? I dont understand what to do next, how to store the key in an environmental variable? On my local system? But i thought it will take the secret from key vault? This is my first C# project, i started this week and have no clue what to do. Maybe someone can help/give advice?

Best regards, Frederik

Answer 1

Though storing the public key in the Key vault is good, since it is a public key, it is not necessary. 'Public' itself means that it is non-sensitive. If you do use the key vault, you will need to configure your function to have access to the key vault and if you your key vault has restricted IPs, that would lead to additional setup, cost and effort.

If you store your base64 encoded string into one of the application configuration settings on the function app with keyname as pgp-public-key, you will be able to access it using the following line

string publicKeyBase64 = Environment.GetEnvironmentVariable("pgp-public-key");

This will work fine while running on cloud. For local testing, you will need a local.settings.json with your base64 encoded value specified on your local machine. The contents will look like this.

{
  "IsEncrypted": false,
  "Values": {
    "AzureWebJobsStorage": "",
    "FUNCTIONS_WORKER_RUNTIME": "dotnet",
    "pgp-public-key": "<your base 64 encoded public key>"
  }
}

When you create a function on VScode, this file is automatically created for you. You just need to modify it with your environment variables.

With this you can test this locally on your machine or on cloud without modifying the code. You can find more information of the local development HERE.