Examkin

Question

Difficulty: Very hardConfigure Azure App Service Web Apps

An organization deploys an Azure App Service web app named `app-retail` with a production slot and a deployment slot named `staging`. Each slot is configured with a system-assigned managed identity. You have two Azure Key Vaults:

* `kv-retail-prod` containing a secret named `DbConn`. The Key Vault access policy grants GET permissions to the production slot's system-assigned managed identity.
* `kv-retail-stage` containing a secret named `DbConn`. The Key Vault access policy grants GET permissions to the staging slot's system-assigned managed identity.

You configure the following application setting in both slots (without marking it as a deployment slot setting):

* Production slot: `DbConnectionString = @Microsoft.KeyVault(SecretUri=https://kv-retail-prod.vault.azure.net/secrets/DbConn/)`
* Staging slot: `DbConnectionString = @Microsoft.KeyVault(SecretUri=https://kv-retail-stage.vault.azure.net/secrets/DbConn/)`

You perform a standard deployment slot swap between the `staging` slot and the production slot. Immediately after the swap completes, you observe that the web app fails to connect to the database in both slots because the Key Vault references cannot be resolved.

Which of the following actions will resolve the Key Vault reference resolution failures while adhering to the principle of least privilege?

  1. Configure the DbConnectionString application setting as a deployment slot setting (sticky to slot) in both slots.Answer
  2. B
    Grant the system-assigned managed identity of the production slot GET permissions on kv-retail-stage, and grant the system-assigned managed identity of the staging slot GET permissions on kv-retail-prod.
  3. C
    Modify the Key Vault reference in the production slot to use the staging identity by adding the parameter ;UserAssignedIdentity=staging to the SecretUri query string.
  4. D
    Configure a shared User-Assigned Managed Identity, assign it to both slots, grant it GET permissions on both Key Vaults, and update the setting to @Microsoft.AppConfiguration(SecretUri=https://kv-retail-prod.vault.azure.net/secrets/DbConn/;UserAssignedIdentity=shared-identity).

Answer

Configure the DbConnectionString application setting as a deployment slot setting (sticky to slot) in both slots.
The correct answer is to configure the DbConnectionString application setting as a deployment slot setting (sticky to slot) in both slots. When a setting is marked as a deployment slot setting, its value remains on its original slot and is not swapped during a slot swap operation. This allows the production slot to continue using the reference to the production Key Vault (which its system-assigned managed identity is authorized to access) and the staging slot to continue using the reference to the staging Key Vault (which its system-assigned managed identity is authorized to access), resolving the resolution failures without changing access policies.

Step-by-Step Solution

1
Analyze the cause of the Key Vault reference resolution failures.
When the slots are swapped, the non-sticky DbConnectionString settings are swapped between slots. The production slot now has the staging Key Vault reference (kv-retail-stage), and the staging slot has the production Key Vault reference (kv-retail-prod). However, their system-assigned managed identities do not swap.
System-assigned managed identities are bound to the slot resource. The production slot's identity attempts to read from kv-retail-stage, and the staging slot's identity attempts to read from kv-retail-prod, both of which lack the required Key Vault access policies.
2
Determine how to keep slot-specific settings from being swapped.
By marking the DbConnectionString setting as a deployment slot setting (also known as a sticky setting) in both slots, Azure prevents the setting value from being exchanged during a swap operation.
This keeps the production Key Vault reference on the production slot (which uses the production identity) and the staging Key Vault reference on the staging slot (which uses the staging identity).
3
Verify compliance with the principle of least privilege.
No identity is granted access to secrets it does not need. The staging slot's identity only has access to kv-retail-stage, and the production slot's identity only has access to kv-retail-prod.
This satisfies the requirement to resolve the failures while adhering to the principle of least privilege.

Key Concept

Understanding the behavior of system-assigned managed identities and slot-sticky application settings during Azure App Service deployment slot swaps.
Rate this question

Topics

Configure Azure App Service Web Apps

More questions from this topic