Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

You are developing an Azure Function App in C# that needs to retrieve a third-party API key stored as a secret in an Azure Key Vault. The Function App must authenticate to Key Vault securely using a system-assigned managed identity, adhering to the principle of least privilege.

Which five actions should you perform in sequence to configure the resources and write the code? To answer, arrange all the actions from the list of actions to the correct order.

  1. 1Enable the system-assigned managed identity on the Azure Function App resource.
  2. 2Assign the Key Vault Secrets User role to the Function App's managed identity on the target Key Vault.
  3. 3In the Function App code, instantiate a DefaultAzureCredential object from the Azure.Identity namespace.
  4. 4Instantiate a SecretClient from the Azure.Security.KeyVault.Secrets namespace, passing the Key Vault URI and the credential object.
  5. 5Call the GetSecretAsync method on the SecretClient object to retrieve the API key secret.

Answer

To retrieve the secret securely, first enable the system-assigned managed identity on the Function App. Next, assign the Key Vault Secrets User RBAC role to this identity to grant read access. In the code, instantiate a DefaultAzureCredential, pass it to initialize a SecretClient, and then call GetSecretAsync to retrieve the secret value.
The correct sequence begins by provisioning the identity, granting it read-only permissions via RBAC (Key Vault Secrets User), instantiating the credential provider (DefaultAzureCredential), initializing the Key Vault client (SecretClient), and executing the secret retrieval request.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Function App.
A service principal is created in Microsoft Entra ID representing the Function App.
This establishes the identity context that will be authorized to access Key Vault.
2
Assign the Key Vault Secrets User RBAC role to the Function App's identity on the Key Vault.
The identity receives the minimum required permissions to read secrets.
Azure RBAC requires a security principal to grant permissions. You must use the Key Vault Secrets User role for least privilege secret reading.
3
Instantiate a DefaultAzureCredential object in the C# code.
A token credential pipeline is created.
The DefaultAzureCredential class automatically discovers the managed identity when deployed to Azure.
4
Instantiate a SecretClient passing the Key Vault URI and the DefaultAzureCredential.
A SecretClient instance is initialized.
The SecretClient from the Azure.Security.KeyVault.Secrets library handles all API operations against Key Vault.
5
Call the GetSecretAsync method on the SecretClient.
The secret containing the API key is retrieved.
This makes the actual network call to Key Vault to return the secret value.

Key Concept

Establishing a secure connection from an Azure Function App to Azure Key Vault using modern C# SDKs and a managed identity with role-based access control.
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic