Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

A secure C# Web API is hosted on an Azure App Service instance that has a system-assigned managed identity enabled. The Web API needs to retrieve a database connection string stored as a secret in an Azure Key Vault named kv-prod. The Key Vault is configured to use the Azure role-based access control (Azure RBAC) permission model. During testing, the Web API receives a 403 Forbidden error when attempting to retrieve the secret. You need to resolve the authorization issue while adhering to the principle of least privilege. What should you do?

  1. Assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope.Answer
  2. B
    Create a Key Vault access policy in kv-prod that grants Get secret permissions to the App Service's system-assigned managed identity.
  3. C
    Configure an application setting in the App Service that references the secret using the syntax @KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/db-conn-string).
  4. D
    Create a user-assigned managed identity, assign the Key Vault Secrets Officer role to it, and configure the App Service to use this identity.

Answer

Assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope.
Assigning the Key Vault Secrets User role to the system-assigned managed identity at the Key Vault scope is the correct solution. Since the Key Vault uses the Azure RBAC permission model, traditional access policies are disabled. The Key Vault Secrets User role provides the minimum permissions necessary to retrieve secret values, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the active authorization model for the Key Vault.
The Key Vault is configured to use the Azure RBAC permission model.
This determines whether to use role assignments or access policies.
2
Determine the minimum required permissions to read a secret.
The Key Vault Secrets User role is required to read secret values.
The Key Vault Secrets Officer role grants write/delete permissions and violates the principle of least privilege.
3
Assign the role to the correct identity at the appropriate scope.
Assign the Key Vault Secrets User role to the App Service's system-assigned managed identity at the Key Vault scope.
This authorizes the Web API to retrieve the connection string securely and with least privilege.

Key Concept

Azure Key Vault authorization using the Azure RBAC permission model
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic