Examkin

Question

Difficulty: Very hardSecure App Configuration and Key Vault References

You are hosting an ASP.NET Core web application in an Azure App Service. The application requires a database connection string stored as a secret named db-conn in an Azure Key Vault named prod-kv. You create a user-assigned managed identity named app-identity and associate it with the App Service. In prod-kv, you grant the Key Vault Secrets User role to app-identity using Azure RBAC. In the App Service configuration, you add an application setting named ConnectionStrings__DefaultConnection with the value @Microsoft.KeyVault(SecretUri=https://prod-kv.vault.azure.net/secrets/db-conn/). However, the App Service fails to resolve the Key Vault reference at runtime and the application cannot retrieve the database connection string. Which of the following actions should you take to resolve this issue?

  1. A
    Disable Azure RBAC on the Key Vault and configure a Key Vault Access Policy to grant Secret Get permissions to the App Service.
  2. B
    Modify the application setting value to omit the trailing slash, changing it to @Microsoft.KeyVault(SecretUri=https://prod-kv.vault.azure.net/secrets/db-conn).
  3. Configure the App Service's keyVaultReferenceIdentity property to point to the resource ID of app-identity.Answer
  4. D
    Remove the user-assigned identity, enable the system-assigned managed identity on the App Service, and grant it the Key Vault Secrets User role on the Key Vault.

Answer

Configure the App Service's keyVaultReferenceIdentity property to point to the resource ID of app-identity.
To resolve Key Vault references using a user-assigned managed identity, you must set the keyVaultReferenceIdentity property of the App Service to the resource ID of the user-assigned identity. By default, the App Service attempts to use its system-assigned managed identity, which fails if it is not configured or lacks permissions.

Step-by-Step Solution

1
Identify the authentication mechanism used for resolving Key Vault references.
The App Service is configured with a user-assigned managed identity (app-identity) and lacks a system-assigned managed identity.
By default, App Service attempts to resolve Key Vault references using the system-assigned managed identity.
2
Set the Key Vault reference identity property.
Update the keyVaultReferenceIdentity property of the App Service to point to the Resource ID of the user-assigned identity.
This explicitly tells the App Service which user-assigned managed identity to use for authenticating against the Key Vault to resolve reference strings.
3
Verify reference resolution in the App Service configuration.
The reference status changes to Resolved, and the application successfully retrieves the secret value at runtime.
Once the identity is mapped and permissions are verified, App Service can fetch the secret content.

Key Concept

Using user-assigned managed identities to resolve App Service Key Vault references.
Estimated Time:3m 0s
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic