You need to configure an Azure App Service web app named app1 to run a container image hosted in a private Azure Container Registry (ACR) named acr1. The web app must authenticate to the registry using its own system-assigned managed identity. Which sequence of actions should you perform? To answer, arrange the actions in the correct order.
- 1Enable the system-assigned managed identity on the App Service web app.
- 2Assign the AcrPull role to the web app's system-assigned managed identity on the Azure Container Registry.
- 3Configure the web app's container settings to reference the registry, repository, and tag, and set the credentials to use the managed identity.
- 4Restart the App Service web app to trigger the pull of the container image.
Answer
First, enable the system-assigned managed identity on the App Service web app. Second, assign the AcrPull role to the web app's system-assigned managed identity on the Azure Container Registry. Third, configure the web app's container settings to reference the registry, repository, and tag, and set the credentials to use the managed identity. Finally, restart the App Service web app to trigger the pull of the container image.
To secure communications between Azure App Service and Azure Container Registry without hardcoded credentials, you must first enable the system-assigned managed identity on the web app. This creates a service principal. Next, you authorize this service principal by granting it the AcrPull role on the registry. Then, you configure the container deployment settings on the web app to utilize the registry and authentication via the managed identity. Finally, you restart the web app to apply the configuration and initiate the pull.
Step-by-Step Solution
Key Concept
Configuring container settings and system-assigned managed identities for Azure App Service to authenticate against Azure Container Registry.