An application running inside an Azure Container Instances (ACI) container group is configured to use a system-assigned managed identity to access an Azure Key Vault. When the application attempts to retrieve a secret, it receives an HTTP 403 Forbidden error. You confirm that the system-assigned managed identity is enabled on the container group. Which action must you perform to resolve the access error?
- AModify the container group's YAML configuration to use a user-assigned managed identity, because system-assigned managed identities cannot be granted permissions to Key Vault.
- BConfigure the container group deployment by setting the imageRegistryCredentials property to include the Key Vault client credentials.
- Configure an access policy or Azure Role-Based Access Control (RBAC) role assignment on the Key Vault that grants 'Get' permission for secrets to the container group's identity.Answer
- DUpdate the application's configuration by defining a Key Vault reference using the @Microsoft.KeyVault(SecretUri=...) syntax in the container environment variables.
Answer
Configure an access policy or Azure Role-Based Access Control (RBAC) role assignment on the Key Vault that grants 'Get' permission for secrets to the container group's identity.
The HTTP 403 Forbidden error indicates that authentication was successful (the container has an identity), but authorization failed because the Key Vault access policies or RBAC roles do not permit the system-assigned managed identity to access the secrets. Granting 'Get' permission to the identity resolves the issue.
Step-by-Step Solution
Key Concept
Assigning Key Vault permissions to an ACI system-assigned managed identity
Estimated Time:1m 30s