Examkin

Question

Difficulty: MediumSecure App Configuration and Key Vault References

You are configuring a Python FastAPI web application hosted on Azure App Service to load its settings from an Azure App Configuration store. One of the keys in the App Configuration store, DbConnectionString, is configured as a Key Vault reference pointing to a secret in Azure Key Vault. The App Service is configured to use a system-assigned managed identity. At runtime, the application successfully retrieves standard key-values from the App Configuration store but fails with an authorization error when attempting to resolve the value of the DbConnectionString key. How should you resolve this issue?

  1. Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault.Answer
  2. B
    Grant the Azure App Configuration instance's managed identity the Key Vault Secrets User role on the Azure Key Vault.
  3. C
    Update the value of the DbConnectionString key in Azure App Configuration to use the @Microsoft.KeyVault(SecretUri=...) format.
  4. D
    Configure the App Service to use a user-assigned managed identity instead of a system-assigned managed identity.

Answer

Grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault.
The correct solution is to grant the App Service's system-assigned managed identity the Key Vault Secrets User role on the Azure Key Vault. In Azure App Configuration, Key Vault references are resolved client-side by the application client library. This library uses the credentials supplied to the configuration provider (in this scenario, the system-assigned managed identity of the App Service) to authenticate directly against the Azure Key Vault. Therefore, the App Service's identity requires direct access to read secrets in the Key Vault.

Step-by-Step Solution

1
Identify where the Key Vault reference resolution takes place.
The App Configuration provider library resolves Key Vault references client-side within the application process.
Understanding the client-side nature of Key Vault references in App Configuration is critical for setting permissions on the correct identity.
2
Determine which identity is executing the application process.
The App Service's system-assigned managed identity.
Since the application runs on the App Service, it uses the App Service's identity to connect to resources.
3
Assign the appropriate RBAC role to the App Service's identity on the Key Vault.
Assign Key Vault Secrets User role (or Get permissions in access policies) to the App Service's identity.
This grants the application permission to fetch the secret value during the configuration loading process.

Key Concept

Key Vault Reference Resolution in Azure App Configuration
Estimated Time:1m 30s
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic