Examkin

Question

Difficulty: MediumCreate and Configure Azure Functions

You are developing an Azure Function App (V4 runtime) that must retrieve a database connection string from an Azure Key Vault using Key Vault references. You enable a system-assigned managed identity for the Function App. You then add the following environment variable to the Function App configuration:

DbConnectionString = @Microsoft.KeyVault(SecretUri=https://mykeyvault.vault.azure.net/secrets/db-conn/)

When the function executes, it fails to connect to the database. Upon inspection, you find that the function is retrieving the raw reference string @Microsoft.KeyVault(...) instead of the secret value.

Which of the following is the most likely cause of this behavior?

  1. A
    The Key Vault reference syntax is invalid because it must use the App Configuration reference prefix @Microsoft.AppConfiguration instead of @Microsoft.KeyVault.
  2. B
    The Function App is hosted on a Consumption plan, which does not support the resolution of Key Vault references.
  3. The system-assigned managed identity of the Function App has not been granted permission to retrieve secrets from the Key Vault.Answer
  4. D
    The Key Vault reference syntax is invalid because it is missing the client ID of the system-assigned managed identity.

Answer

The system-assigned managed identity of the Function App has not been granted permission to retrieve secrets from the Key Vault.
The system-assigned managed identity of the Function App must be granted permissions to read secrets from the Key Vault. If this permission is missing, the Azure Functions runtime cannot retrieve the secret, and the environment variable is populated with the raw reference string instead of the secret value.

Step-by-Step Solution

1
Identify how Key Vault references are resolved by the Azure Functions host.
The Functions runtime uses the app's managed identity to authenticate and retrieve the secret at startup/execution.
Managed identity authentication is required to access Key Vault secrets without storing credentials in configuration.
2
Determine the behavior of an unresolved Key Vault reference.
If the identity lacks the necessary permissions, the runtime cannot retrieve the secret, and it leaves the environment variable populated with the raw reference string.
This helps locate where the authentication/authorization broke down between the Function App and Key Vault.
3
Verify permissions on the Key Vault.
Grant the system-assigned managed identity the Key Vault Secrets User role or Get permissions in an access policy.
This provides the required authorization for the Function App to fetch the connection string successfully.

Key Concept

Key Vault References and Managed Identities in Azure Functions
Estimated Time:1m 30s
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic