Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

You are developing a secure C# web API that retrieves a database credential secret from Azure Key Vault. You need to automate the rotation of this secret using Azure Event Grid and a custom Azure Function. Which sequence of steps should you perform to configure the automated rotation?

  1. 1Deploy the Azure Function containing the rotation logic to a Function App.
  2. 2Enable a system-assigned managed identity for the Function App and assign it the Key Vault Secrets Officer role.
  3. 3Create an Azure Event Grid subscription for the SecretNearExpiry event that targets the Azure Function endpoint.
  4. 4Configure the Key Vault secret with an expiration date and define its rotation policy parameters.

Answer

Deploy the Azure Function, enable its system-assigned managed identity and assign the Key Vault Secrets Officer role, create the Event Grid subscription for the SecretNearExpiry event targeting the function endpoint, and configure the secret's expiration and rotation policy parameters.
The correct order begins with deploying the function so that its endpoint is generated. Then, you enable the system-assigned managed identity and grant it Key Vault Secrets Officer permission to allow it to write new secret versions. Next, you link the function to Key Vault by creating the Event Grid subscription. Finally, you configure the rotation policy on the secret itself to schedule when the rotation sequence starts.

Step-by-Step Solution

1
Deploy the Azure Function containing rotation logic.
The HTTP trigger endpoint becomes active and accessible.
You cannot register an event subscription handler without a valid destination endpoint.
2
Enable system-assigned managed identity and assign Key Vault Secrets Officer role.
The Function App is authorized to perform write and update operations on Key Vault secrets.
The rotation function must write new secret versions to the vault, which requires the Secrets Officer role rather than the read-only Secrets User role.
3
Create an Event Grid subscription for the SecretNearExpiry event.
Key Vault secret expiry notifications are routed to the function.
This links the life cycle event of the secret directly to the custom handler function.
4
Configure the secret rotation policy parameters.
The secret starts automated lifecycle tracking.
The policy defines when the Key Vault will raise the SecretNearExpiry event before the actual secret expiration occurs.

Key Concept

Azure Key Vault automated secret rotation using Event Grid and Azure Functions.
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic