Examkin

Question

Difficulty: HardProvision and Configure Azure API Management

You are configuring a custom gateway domain for an Azure API Management (APIM) instance. The TLS certificate for the custom domain is stored in Azure Key Vault. You have enabled a system-assigned managed identity for the APIM instance. You need to configure the Azure Key Vault access policy to allow the APIM instance to retrieve the TLS certificate while adhering to the principle of least privilege. Which permission must you grant to the APIM system-assigned managed identity in the Key Vault access policy?

  1. `Get` permission under Secret permissionsAnswer
  2. B
    `Get` permission under Certificate permissions
  3. C
    `Get` permission under Key permissions
  4. D
    `List` permission under Secret permissions and `Get` permission under Certificate permissions

Answer

`Get` permission under Secret permissions
The correct answer is the option specifying the `Get` permission under Secret permissions. When configuring a custom domain in Azure API Management using a certificate stored in Key Vault, API Management must retrieve the complete certificate including the private key. In Azure Key Vault, the private key portion of a certificate is stored as a secret, which requires Secret Get permission to retrieve.

Step-by-Step Solution

1
Determine the certificate retrieval mechanism.
API Management retrieves the certificate from Azure Key Vault by accessing it as a secret to obtain the private key.
When a certificate with a private key is imported into Key Vault, the private key is stored as a secret.
2
Identify the minimum permission required for secret retrieval.
The identity requires the 'Get' permission under Secret permissions.
This permission allows the managed identity of the API Management instance to read the certificate content containing the private key.
3
Verify compliance with the principle of least privilege.
Granting Secret Get provides the exact reading capability needed without adding extra administrative permissions like List or Delete.
Using the specific Secret Get permission ensures only the required read access is given.

Key Concept

Azure API Management custom domain configuration requires Key Vault Secret Get permissions to retrieve the certificate's private key.
Estimated Time:2m 0s
Rate this question

Topics

Provision and Configure Azure API Management