Examkin

Question

Difficulty: HardImplement Azure Event Grid Solutions

You are implementing an event-driven solution that uses Azure Event Grid. You have an Event Grid system topic named `kv-system-topic` associated with an Azure Key Vault instance.

You need to configure an event subscription that routes events to an Azure Service Bus queue. The subscription must meet the following requirements:
- Any undelivered events must be written to a private blob container named `dlq-container` in an Azure Storage account named `saeventgridlogs`.
- The system topic must authenticate to the storage account using its system-assigned managed identity.
- Least privilege access must be enforced.

Which sequence of actions should you perform to configure the identity and create the subscription? Arrange the actions in the correct order.

  1. 1Enable the system-assigned managed identity on the kv-system-topic system topic.
  2. 2Retrieve the principal ID of the system-assigned managed identity from kv-system-topic.
  3. 3Assign the Storage Blob Data Contributor role to the system topic's principal ID at the scope of the saeventgridlogs storage account.
  4. 4Create the event subscription, specifying the Service Bus queue endpoint, the dlq-container as the dead-letter destination, and setting the dead-letter identity type to system-assigned.

Answer

Enable the system-assigned managed identity on the system topic, retrieve its principal ID, assign the Storage Blob Data Contributor role to the identity at the storage account scope, and then create the event subscription specifying the Service Bus queue endpoint, the dead-letter blob container, and the system-assigned identity.
To configure an Event Grid subscription with dead-lettering using a system-assigned managed identity, the managed identity must first be enabled on the system topic. Next, the principal ID of that managed identity must be retrieved to allow role assignment. The Storage Blob Data Contributor role must then be assigned to that principal ID at the scope of the destination storage account so that Event Grid has permission to write dead-letter events. Finally, the event subscription can be created referencing the dead-letter container and configuring the dead-letter identity to use the system-assigned identity. Performing these steps in any other order will fail, as Event Grid validates write access to the dead-letter destination at subscription creation time.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Event Grid system topic.
A service principal is created in Microsoft Entra ID representing the kv-system-topic.
This establishes the identity that will be granted access to the storage account.
2
Obtain the principal ID of the newly created managed identity.
The principal ID GUID is retrieved.
The principal ID is required for the subsequent role assignment command.
3
Assign the Storage Blob Data Contributor role to the principal ID at the scope of the saeventgridlogs storage account.
The managed identity is authorized to write blobs to the storage account.
Event Grid must have write permissions to the storage account to successfully validate and write dead-letter events.
4
Create the event subscription, configuring the dead-letter destination and setting the dead-letter identity to system-assigned.
The subscription is validated and created successfully.
Since the identity has the correct permissions, Event Grid's validation check passes and the event subscription is established.

Key Concept

Configuring dead-lettering with managed identities in Azure Event Grid subscription creation.
Rate this question

Topics

Implement Azure Event Grid Solutions