Question

Difficulty: EasyRun Containerized Solutions using Azure Container Instances

You are deploying a containerized application to Azure Container Instances (ACI). The application container needs to pull its image from a private Azure Container Registry (ACR) and retrieve a database connection string secret from an Azure Key Vault. Which two configurations are required to ensure the container can authenticate to the registry and access the secret? (Select two.)

  1. Configure the container group with registry credentials (server, username, and password) or enable a managed identity with permissions to pull from the registry.Answer
  2. Assign a managed identity to the container group and grant it permissions to get secrets in the Azure Key Vault access policies.Answer
  3. C
    Grant secrets access permissions to the Azure Container Instances resource provider directly in the Key Vault access policies.
  4. D
    Configure the container group to pull the image anonymously from the private Azure Container Registry.

Answer

Configure the container group with registry credentials or a managed identity with pull permissions, and assign a managed identity to the container group with Key Vault secret access permissions.
To pull from a private registry, ACI must be provided with registry server credentials or a managed identity assigned the AcrPull role. To access Key Vault secrets, the container group must have a managed identity that is granted GET secrets permission in Key Vault. These settings satisfy both secure pull and runtime secret access requirements.

Step-by-Step Solution

1
Configure Azure Container Registry authentication.
The ACI deployment is configured with ACR credentials or a managed identity with AcrPull role.
Allows ACI to authenticate and pull the container image from the private registry.
2
Enable a managed identity on the container group.
The ACI container group has a system-assigned or user-assigned identity.
Provides a secure identity wrapper that can be authorized in Azure services like Key Vault.
3
Configure Key Vault access policies.
The managed identity is granted GET permissions on secrets in Key Vault.
Allows the container to retrieve the database connection string at runtime.

Key Concept

Azure Container Instances authentication to ACR and Azure Key Vault
Rate this question