Examkin

Question

Difficulty: Very hardRun Containerized Solutions using Azure Container Instances

You are configuring a multi-container group in Azure Container Instances (ACI) using an Azure Resource Manager (ARM) template. An application container within the group must retrieve database credentials from Azure Key Vault at runtime. You configure the container group with a system-assigned managed identity. The deployment completes successfully, but the application container fails to start. Reviewing the container logs reveals an HTTP 403 (Forbidden) error when the application attempts to fetch the credentials from the Key Vault. Which action should you take to resolve this error?

  1. Grant the system-assigned managed identity's principal ID the GET permission on secrets using a Key Vault access policy or Azure RBAC role assignment.Answer
  2. B
    Modify the template to use a user-assigned managed identity, as ACI does not support system-assigned managed identities for accessing Azure resources at runtime.
  3. C
    Configure the credentials under the imageRegistryCredentials property of the container group in the ARM template.
  4. D
    Define the environment variables in the template using the @Microsoft.KeyVault syntax to automatically resolve the secrets.

Answer

Grant the system-assigned managed identity's principal ID the GET permission on secrets using a Key Vault access policy or Azure RBAC role assignment.
The correct action is to grant the system-assigned managed identity's principal ID the GET permission on secrets in the Key Vault. A system-assigned managed identity is automatically created for the container group when deployed, but it requires explicit permissions (such as a Key Vault access policy or an Azure RBAC role like Key Vault Secrets User) to access resources like secrets.

Step-by-Step Solution

1
Verify the managed identity configuration on the container group.
The container group has a system-assigned managed identity enabled, which generates an identity principal in Microsoft Entra ID after provisioning.
To ensure the container group can authenticate to Azure services using its own identity.
2
Identify why the Key Vault request returned an HTTP 403 Forbidden status.
The request failed authorization because the newly created identity principal does not have permission to read secrets from the Key Vault.
A managed identity has zero access permissions by default; permissions must be explicitly assigned.
3
Configure permissions on the Key Vault.
Add an access policy granting GET permission on secrets to the container group's system-assigned managed identity principal ID (or assign the Key Vault Secrets User RBAC role).
To authorize the identity to retrieve the secret values at runtime.

Key Concept

Configuring runtime authorization for ACI container groups using system-assigned managed identities and Key Vault access policies.
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic