fix(azure): wire AppConfiguration in Functions + scope KV crypto

Rubber-duck of Phase 3 flagged two blockers that would have made the
deploy functionally inert.

1) Functions reads `Encryption:KeyVault:Uri` and `:SealKeyName` from
   `IConfiguration` but no AppConfiguration source was wired. The
   `KeyVault__Uri` env var set in functions.bicep maps to `KeyVault:Uri`,
   not `Encryption:KeyVault:Uri` - so Phase 2 KeyVaultKekProvider and
   Phase 3 DekSealingService were silently NOT registered in production.

   Fix: register Microsoft.Extensions.Configuration.AzureAppConfiguration
   in Functions Program.cs with KeyFilter `blkmon:*`, label = AZURE_ENV_NAME
   (default = builder.Environment.EnvironmentName), TrimKeyPrefix `blkmon:`,
   and ConfigureKeyVault for KV-reference resolution. The endpoint comes
   from `AzureAppConfig__Endpoint` which functions.bicep already sets.
   Added new AZURE_ENV_NAME env var (sourced from main.bicep environmentName
   param) so the App Configuration label filter selects environment-scoped
   keys.

2) keyvault.bicep granted vault-wide Key Vault Crypto User to BOTH
   funcIdentity AND webIdentity. Web.Azure today is an empty Blazor
   scaffold that performs no crypto operations directly - so this gave
   Web the ability to wrap/unwrap with blkmon-kek and decrypt with the
   Phase 3 blkmon-agent-seal key, violating least privilege.

   Fix: split keyvault.bicep `consumerPrincipalIds` into
   `cryptoConsumerPrincipalIds` (funcIdentity only, retains operational
   KEK access) and `secretsConsumerPrincipalIds` (funcIdentity + webIdentity,
   needed for KV-reference resolution of the SQL connection string via
   App Configuration). main.bicep updated accordingly.

Tests: Azure slnx 86 + 15 + 8 = 109 green. On-prem slnx 86 green.
`az bicep build infra/main.bicep` compiles clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

infra/main.bicep

@@ -72,7 +72,10 @@ module keyvault 'modules/keyvault.bicep' = {
     keyVaultName: '${abbrs.keyVaultVaults}${resourceToken}'
     tenantId: tenantId
     deployerPrincipalId: principalId
-    consumerPrincipalIds: [
+    cryptoConsumerPrincipalIds: [
+      identity.outputs.funcIdentityPrincipalId
+    ]
+    secretsConsumerPrincipalIds: [
       identity.outputs.webIdentityPrincipalId
       identity.outputs.funcIdentityPrincipalId
     ]
@@ -168,6 +171,7 @@ module functions 'modules/functions.bicep' = {
     funcIdentityClientId: identity.outputs.funcIdentityClientId
     appConfigEndpoint: appConfig.outputs.endpoint
     keyVaultUri: keyvault.outputs.keyVaultUri
+    environmentName: environmentName
   }
 }
 

infra/modules/functions.bicep

@@ -9,6 +9,8 @@ param funcIdentityResourceId string
 param funcIdentityClientId string
 param appConfigEndpoint string
 param keyVaultUri string
+@description('Short environment name (e.g. dev / prod). Surfaced to the Functions runtime as AZURE_ENV_NAME so App Configuration label filtering selects the right environment-scoped keys.')
+param environmentName string
 
 resource storage 'Microsoft.Storage/storageAccounts@2024-01-01' existing = {
   name: storageAccountName
@@ -96,6 +98,10 @@ resource functionApp 'Microsoft.Web/sites@2024-04-01' = {
           name: 'KeyVault__Uri'
           value: keyVaultUri
         }
+        {
+          name: 'AZURE_ENV_NAME'
+          value: environmentName
+        }
       ]
     }
   }

infra/modules/keyvault.bicep

@@ -4,8 +4,10 @@ param keyVaultName string
 param tenantId string
 @description('Object ID of the deployer principal (gets Key Vault Administrator). Empty disables this assignment.')
 param deployerPrincipalId string
-@description('Object IDs of workload identities (web, func) that need wrapKey/unwrapKey for the KEK and Get for secrets resolved via App Configuration KV-references.')
-param consumerPrincipalIds array
+@description('Object IDs of identities that need wrapKey/unwrapKey on the operational KEK. Typically the Functions UAMI only — Web does not perform crypto operations directly.')
+param cryptoConsumerPrincipalIds array
+@description('Object IDs of identities that need Get on KV secrets (e.g. SQL connection string resolved via App Configuration KV-references). Typically Functions + Web.')
+param secretsConsumerPrincipalIds array
 @description('Object IDs of identities that need encrypt rights on the agent-seal key (Phase 3 Functions producer). Typically the Functions UAMI. Empty disables.')
 param sealKeyEncryptPrincipalIds array = []
 @description('Object IDs of identities that need decrypt rights on the agent-seal key (Phase 3 HybridAgent consumer). Typically the HybridAgent UAMI / SPN. Empty disables — provision the agent identity then re-run azd.')
@@ -89,7 +91,7 @@ resource adminRa 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!emp
   }
 }
 
-resource cryptoUserRa 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for pid in consumerPrincipalIds: {
+resource cryptoUserRa 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for pid in cryptoConsumerPrincipalIds: {
   scope: keyVault
   name: guid(keyVault.id, pid, kvCryptoUserRoleId)
   properties: {
@@ -99,7 +101,7 @@ resource cryptoUserRa 'Microsoft.Authorization/roleAssignments@2022-04-01' = [fo
   }
 }]
 
-resource secretsUserRa 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for pid in consumerPrincipalIds: {
+resource secretsUserRa 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for pid in secretsConsumerPrincipalIds: {
   scope: keyVault
   name: guid(keyVault.id, pid, kvSecretsUserRoleId)
   properties: {

src/BitLockerKeyMonitor.Functions/Program.cs

@@ -5,6 +5,8 @@
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Builder;
 using Microsoft.Azure.Functions.Worker.OpenTelemetry;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Configuration.AzureAppConfiguration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using OpenTelemetry;
@@ -13,6 +15,34 @@
 
 builder.ConfigureFunctionsWebApplication();
 
+// ---------------- Azure App Configuration ----------------
+// Wires builder.Configuration to read keys seeded by infra/modules/appconfig.bicep. Keys are
+// stored with the "blkmon:" prefix and an environment-name label (e.g. dev / prod); TrimKeyPrefix
+// strips the prefix so callers can read "Encryption:KeyVault:Uri" directly. ConfigureKeyVault
+// resolves App Configuration KV-references (e.g. SQL connection string) via the same managed
+// identity. Without this block, the Phase 2 KeyVaultKekProvider and Phase 3 DekSealingService
+// would silently fail to register because their config keys would always resolve to null.
+
+var appConfigEndpoint = builder.Configuration["AzureAppConfig:Endpoint"]
+    ?? Environment.GetEnvironmentVariable("AzureAppConfig__Endpoint");
+var envLabel = builder.Configuration["AzureAppConfig:Label"]
+    ?? Environment.GetEnvironmentVariable("AZURE_ENV_NAME")
+    ?? builder.Environment.EnvironmentName;
+
+if (!string.IsNullOrEmpty(appConfigEndpoint))
+{
+    var appConfigCredential = new DefaultAzureCredential();
+    builder.Configuration.AddAzureAppConfiguration(options =>
+    {
+        options
+            .Connect(new Uri(appConfigEndpoint), appConfigCredential)
+            .Select("blkmon:*", LabelFilter.Null)
+            .Select("blkmon:*", envLabel)
+            .TrimKeyPrefix("blkmon:")
+            .ConfigureKeyVault(kv => kv.SetCredential(appConfigCredential));
+    });
+}
+
 if (!string.IsNullOrEmpty(Environment.GetEnvironmentVariable("APPLICATIONINSIGHTS_CONNECTION_STRING")))
 {
     builder.Services.AddOpenTelemetry()