You are deploying a containerized application to Azure Container Instances (ACI). The application container needs to pull its image from a private Azure Container Registry (ACR) and retrieve a database connection string secret from an Azure Key Vault. Which two configurations are required to ensure the container can authenticate to the registry and access the secret? (Select two.)
- Configure the container group with registry credentials (server, username, and password) or enable a managed identity with permissions to pull from the registry.Answer
- Assign a managed identity to the container group and grant it permissions to get secrets in the Azure Key Vault access policies.Answer
- CGrant secrets access permissions to the Azure Container Instances resource provider directly in the Key Vault access policies.
- DConfigure the container group to pull the image anonymously from the private Azure Container Registry.
Answer
Configure the container group with registry credentials or a managed identity with pull permissions, and assign a managed identity to the container group with Key Vault secret access permissions.
To pull from a private registry, ACI must be provided with registry server credentials or a managed identity assigned the AcrPull role. To access Key Vault secrets, the container group must have a managed identity that is granted GET secrets permission in Key Vault. These settings satisfy both secure pull and runtime secret access requirements.
Step-by-Step Solution
Key Concept
Azure Container Instances authentication to ACR and Azure Key Vault