Examkin

Question

Difficulty: Very hardProvision and Configure Azure API Management

You are configuring a custom gateway domain for an Azure API Management (APIM) instance named `apim-prod`. The SSL/TLS certificate for the custom domain `api.contoso.com` is stored in an Azure Key Vault named `kv-prod`. The security team requires that the custom domain must automatically use the latest version of the certificate whenever it is renewed in the Key Vault. You have enabled a system-assigned managed identity for the `apim-prod` instance. Which configuration steps should you implement to meet these requirements?

  1. A
    Configure an access policy in the key vault that grants the API Management system-assigned managed identity the Get permission for Certificates. In the API Management custom domain settings, configure the certificate using a Key Vault certificate URI that includes the specific certificate version.
  2. B
    Configure an access policy in the key vault that grants the API Management system-assigned managed identity the Get permission for Secrets. In the API Management custom domain settings, configure the certificate using a Key Vault secret URI that includes the specific secret version.
  3. Configure an access policy in the key vault that grants the API Management system-assigned managed identity the Get permission for Secrets. In the API Management custom domain settings, configure the certificate using a Key Vault secret URI that excludes the specific secret version.Answer
  4. D
    Configure an access policy in the key vault that grants the API Management built-in service principal the Get permission for Keys. In the API Management custom domain settings, configure the certificate using a Key Vault secret URI that excludes the specific secret version.

Answer

Configure an access policy in the key vault that grants the API Management system-assigned managed identity the Get permission for Secrets. In the API Management custom domain settings, configure the certificate using a Key Vault secret URI that excludes the specific secret version.
To configure a custom domain in Azure API Management using a certificate from Key Vault with auto-rotation, two conditions must be met: First, API Management must be granted 'Secret Get' permission in Key Vault. This is because SSL/TLS certificates containing private keys are accessed as secrets. Second, the secret identifier URI specified in API Management must exclude the version segment, prompting API Management to periodically pull the latest version of the certificate.

Step-by-Step Solution

1
Assign Key Vault permissions to the API Management system-assigned managed identity.
The identity receives the 'Secret Get' permission inside the key vault.
API Management requires Secret Get permissions to retrieve the certificate alongside its private key, which is represented as a secret within Key Vault.
2
Configure the custom domain in the API Management instance settings.
The gateway hostname is linked to the Key Vault certificate resource.
This links the custom domain endpoint to the secret identifier from Key Vault.
3
Reference the Key Vault secret URI without specifying the version identifier.
The certificate is bound to the custom domain and will auto-rotate when a new version is created in Key Vault.
Omitting the version identifier enables auto-rotation. If a version identifier is included in the URI, API Management will remain pinned to that specific version indefinitely.

Key Concept

Key Vault integration for custom domains in Azure API Management with certificate auto-rotation.
Estimated Time:3m 0s
Rate this question

Topics

Provision and Configure Azure API Management