Examkin

Question

Difficulty: MediumRun Containerized Solutions using Azure Container Instances

You are configuring a deployment of a containerized web application to Azure Container Instances (ACI). The container image is stored in a private Azure Container Registry (ACR) named `myregistry.azurecr.io`. During container startup, the web application must retrieve a database password from an Azure Key Vault named `mykeyvault`. You want to use a managed identity to authenticate both the image pull from ACR and the secret retrieval from Key Vault, without storing any credentials in the deployment configuration files. Which configuration strategy should you implement?

  1. A
    Configure a system-assigned managed identity on the container group. Assign the identity the AcrPull role on the registry and access policy permissions to read secrets from the Key Vault. Reference this system-assigned identity in the container group's registry credentials configuration.
  2. Configure a user-assigned managed identity. Assign the identity the AcrPull role on the registry and access policy permissions to read secrets from the Key Vault. Reference this user-assigned identity in both the container group's identity configuration and container registry credentials.Answer
  3. C
    Configure a user-assigned managed identity. Assign the identity the AcrPull role on the registry. Store the Key Vault client ID and secret directly in the container's environment variables to authenticate secret retrieval from the Key Vault.
  4. D
    Configure a user-assigned managed identity. Assign the identity access policy permissions to read secrets from the Key Vault. Configure the container's command to execute a script that runs the az acr login command prior to starting the web application.

Answer

Configure a user-assigned managed identity, assign it the AcrPull role on the Azure Container Registry and access policy permissions to read secrets from Key Vault, and reference the identity in the container group's configuration.
A user-assigned managed identity is required because Azure Container Instances must authenticate to the private Azure Container Registry before the container group is created and started. A system-assigned managed identity is only created after the container group is provisioned and therefore cannot be used for the initial image pull. Furthermore, granting the user-assigned identity the necessary roles/permissions on both the registry and Key Vault ensures secure, passwordless access throughout the application lifecycle.

Step-by-Step Solution

1
Identify the authentication requirements for the image pull phase.
Determine that ACI requires credentials or an identity that exists prior to container group provisioning, making user-assigned managed identities necessary.
System-assigned identities do not exist until the resource creation is complete, so they cannot be used to authenticate the pull of the image used to create the resource.
2
Identify the authentication requirements for the runtime phase (Key Vault access).
Determine that the same user-assigned managed identity can be granted permissions in Key Vault.
Using a single user-assigned managed identity simplifies resource management and security configuration.
3
Grant permissions and configure the ACI container group definition.
Assign the user-assigned identity the AcrPull role on the registry, Secret GET permission in Key Vault, and configure the container group YAML or CLI command to use this identity for registry credentials and group identity.
This satisfies all authorization requirements securely using the principle of least privilege without hardcoding secrets.

Key Concept

Using user-assigned managed identity for private registry image pull in Azure Container Instances
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic