Examkin

Question

Difficulty: HardSystem-Assigned and User-Assigned Managed Identities

An organization is deploying a C# .NET 8 application to an Azure App Service. The application must perform the following tasks:

1. Retrieve configuration secrets from an Azure Key Vault. The Key Vault is shared across several independent applications, and the credentials used to access it must persist even if this App Service instance is deleted.
2. Read messages from an Azure Service Bus queue. The credentials used for the queue must be exclusively tied to this App Service instance's lifecycle and automatically cleaned up if the App Service is deleted.

The application uses the `Azure.Identity` library and `DefaultAzureCredential` to connect to Azure resources.

Which two actions should you perform to implement this configuration?

  1. Enable a system-assigned managed identity on the App Service, assign it the Azure Service Bus Data Receiver role on the Service Bus queue, and instantiate the Service Bus client using a default DefaultAzureCredential instance.Answer
  2. Create a user-assigned managed identity, assign it the Key Vault Secrets User role on the Key Vault, associate it with the App Service, and instantiate the Key Vault client using a DefaultAzureCredential instance initialized with DefaultAzureCredentialOptions containing the identity's client ID.Answer
  3. C
    Enable a system-assigned managed identity on the App Service, assign it the Key Vault Secrets User role on the Key Vault, and instantiate the Key Vault client using a default DefaultAzureCredential instance.
  4. D
    Create a user-assigned managed identity, assign it the Azure Service Bus Data Receiver role on the Service Bus queue, and configure the App Service application settings with the environment variable AZURE_CLIENT_ID set to the client ID of the user-assigned managed identity.

Answer

To implement this configuration, you should enable a system-assigned managed identity on the App Service for the Service Bus queue, assigning it the Azure Service Bus Data Receiver role and instantiating the Service Bus client using a default DefaultAzureCredential instance. Additionally, you should create a user-assigned managed identity for the Key Vault, assigning it the Key Vault Secrets User role, associating it with the App Service, and instantiating the Key Vault client by passing DefaultAzureCredentialOptions containing the identity's client ID to DefaultAzureCredential.
The correct solution uses a system-assigned managed identity for the Service Bus queue because the identity's lifecycle must be linked to the App Service's lifecycle. It uses a user-assigned managed identity for the Key Vault because the credentials must persist independently of the App Service. When both managed identities are enabled on the App Service, DefaultAzureCredential will default to the system-assigned identity unless explicitly configured. Thus, the Service Bus client can use the default credential parameterless constructor, while the Key Vault client must specify the user-assigned identity's client ID via DefaultAzureCredentialOptions.

Step-by-Step Solution

1
Analyze the identity lifecycle requirements for the shared Key Vault and the exclusive Service Bus queue.
Determine that the Key Vault requires a user-assigned managed identity because the credentials must persist independently of the App Service. Determine that the Service Bus queue requires a system-assigned managed identity because the credentials must be tied to the App Service's lifecycle.
System-assigned identities are tied to the host resource's lifecycle, whereas user-assigned identities exist as independent Azure resources.
2
Determine the appropriate RBAC roles for each resource.
Grant the Key Vault Secrets User role to the user-assigned managed identity on the Key Vault. Grant the Azure Service Bus Data Receiver role to the system-assigned managed identity on the Service Bus queue.
This grants the minimum required permissions to perform the operations securely.
3
Configure the Azure.Identity SDK in code to support both identities.
Instantiate the Service Bus client with a parameterless DefaultAzureCredential. Instantiate the Key Vault client with a DefaultAzureCredential configured with DefaultAzureCredentialOptions containing the user-assigned identity's client ID.
When both system-assigned and user-assigned identities are present, DefaultAzureCredential defaults to using the system-assigned identity. To use the user-assigned identity, its client ID must be explicitly provided in the options.

Key Concept

Selecting and configuring system-assigned and user-assigned managed identities based on resource lifecycle, sharing requirements, and multi-identity SDK configuration.
Rate this question

Topics

System-Assigned and User-Assigned Managed Identities

More questions from this topic