An organization requires an Azure API Management (APIM) instance to securely retrieve a database password from an Azure Key Vault secret. The password will be exposed to API policies via a Named Value. You must use a user-assigned managed identity named apim-identity to authenticate from the APIM instance to the Key Vault.
Which two configurations should you implement to achieve this? (Choose two.)
- Associate the apim-identity user-assigned managed identity with the APIM instance.Answer
- Grant the apim-identity user-assigned managed identity the Secret Get permission in the Key Vault access policies or Azure Role-Based Access Control (RBAC).Answer
- CEnable the system-assigned managed identity on the APIM instance and assign it the Secret Get permission on the Key Vault.
- DGrant the apim-identity user-assigned managed identity the Secret List and Secret Backup permissions on the Key Vault.
Answer
To configure the APIM instance to retrieve the secret from the Key Vault using a user-assigned managed identity, you must associate the user-assigned managed identity (apim-identity) with the APIM instance, and grant this identity the Secret Get permission on the Key Vault.
To retrieve a secret value from Key Vault for an APIM Named Value using a user-assigned managed identity, two configuration steps are required: 1) Associate the user-assigned managed identity with the APIM instance so it is available for use. 2) Grant the user-assigned managed identity the Secret Get permission on the Key Vault access policies or Azure RBAC so it has permission to read the secret value.
Step-by-Step Solution
Key Concept
Configuring Azure API Management Named Values to retrieve secrets from Key Vault using a user-assigned managed identity.