An organization is deploying an ASP.NET Core web application to an Azure App Service. The application must retrieve a database password from an Azure Key Vault named `kv-finance-prod`. The Key Vault's permission model is configured to use Azure role-based access control (Azure RBAC). The App Service has a system-assigned managed identity enabled.
During testing, the application's C# code throws a `RequestFailedException` with an HTTP `403 Forbidden` error when calling `SecretClient.GetSecretAsync`.
You need to resolve this authorization issue using the principle of least privilege.
Which of the following actions should you perform?
- ACreate an access policy in `kv-finance-prod` that grants the Get secret permission to the App Service's system-assigned managed identity.
- BAssign the Key Vault Reader role to the App Service's system-assigned managed identity at the Key Vault scope.
- Assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope.Answer
- DCreate a user-assigned managed identity, assign it the Key Vault Secrets User role at the Key Vault scope, and configure the App Service to use the system-assigned managed identity.
Answer
Assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope.
Assigning the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope is the correct solution because it grants the identity the necessary data-plane permissions to read secret values, and it adheres to the principle of least privilege. Because the Key Vault is configured with the Azure RBAC permission model, Azure RBAC roles must be used instead of classic access policies.
Step-by-Step Solution
Key Concept
Assigning appropriate Azure RBAC roles to managed identities for Key Vault secrets retrieval
Estimated Time:1m 30s