Examkin

Question

Difficulty: MediumDefine API Management Policies

You are troubleshooting an Azure API Management (APIM) instance. A backend API requires an API key, which is stored in Azure Key Vault. You have created an APIM named value named `BackendApiKey` that references the Key Vault secret using the APIM instance's system-assigned managed identity.

You apply the following policy to the inbound section of the API:

xml
<inbound>
<base />
<set-header name="X-Api-Key" exists-action="override">
<value>{{BackendApiKey}}</value>
</set-header>
</inbound>

When clients call the API, they receive an HTTP 500 Internal Server Error. The APIM trace logs show that the named value `BackendApiKey` could not be resolved from Key Vault.

Which of the following is the most likely cause of this error?

  1. The system-assigned managed identity of the Azure API Management instance has not been granted GET permissions on secrets in the Key Vault access policies or Azure role-based access control (RBAC).Answer
  2. B
    The <set-header> policy is placed in the <inbound> section, but named values referencing Key Vault secrets can only be resolved within the <outbound> section.
  3. C
    The APIM instance is attempting to resolve the Key Vault reference using a system-assigned managed identity, but Key Vault secret resolution in APIM is only supported when using a user-assigned managed identity.
  4. D
    The syntax used to reference the named value in the policy is incorrect; it must use the App Configuration reference format @Microsoft.KeyVault(SecretUri=...) instead of double curly braces.

Answer

The system-assigned managed identity of the Azure API Management instance has not been granted GET permissions on secrets in the Key Vault access policies or Azure role-based access control (RBAC).
For Azure API Management to retrieve a secret from Key Vault using a system-assigned managed identity, the identity must have GET permission on secrets in the Key Vault. This can be configured either through Key Vault access policies or by assigning the Key Vault Secrets User RBAC role to the APIM instance's identity.

Step-by-Step Solution

1
Identify the mechanism used to fetch the secret.
The named value BackendApiKey is configured to fetch a secret from Azure Key Vault using the APIM system-assigned managed identity.
Understanding how the value is resolved helps pinpoint the security and access control boundaries.
2
Evaluate access requirements for managed identities reading from Key Vault.
The managed identity requires explicit GET permission on secrets in the target Key Vault's access policies or via Azure RBAC (Key Vault Secrets User role).
Without this permission, Key Vault will deny the request, causing the named value resolution to fail and return an HTTP 500 error.
3
Verify APIM policy syntax and section placement.
The syntax {{BackendApiKey}} is correct for named values, and the inbound section is the correct place to intercept and modify requests before they go to the backend.
This rules out syntactical or structural configuration issues in the APIM policy itself.

Key Concept

Azure API Management named values can reference secrets stored in Azure Key Vault. When using a managed identity to fetch these secrets, the identity must be granted GET permission in Key Vault.
Estimated Time:1m 30s
Rate this question

Topics

Define API Management Policies

More questions from this topic