Examkin

Question

Difficulty: EasyRun Containerized Solutions using Azure Container Instances

You are deploying a containerized application to Azure Container Instances (ACI). The container needs to retrieve secrets from an Azure Key Vault at runtime. You have successfully enabled a system-assigned managed identity for the ACI container group. Which of the following actions must you perform to allow the container group to retrieve the secrets from the key vault?

  1. Grant the system-assigned managed identity GET permission to secrets in the Azure Key Vault access policies or Azure RBAC.Answer
  2. B
    Replace the system-assigned managed identity with a user-assigned managed identity because Azure Key Vault only supports user-assigned managed identities.
  3. C
    Configure the container group to authenticate to Azure Key Vault using the Azure Container Registry credentials.
  4. D
    Reference the secrets in the container group configuration using the @Microsoft.KeyVault syntax within the container's environment variables.

Answer

Grant the system-assigned managed identity GET permission to secrets in the Azure Key Vault access policies or Azure RBAC.
To retrieve secrets from Azure Key Vault, the container's managed identity must be granted the necessary permissions (such as GET/LIST) in the Key Vault access policies or via Azure RBAC. Enabling the identity only registers it with Microsoft Entra ID; it does not grant permissions by default.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Azure Container Instances (ACI) container group.
The container group receives an identity registered in Microsoft Entra ID.
This establishes a security identity for ACI without needing hardcoded credentials in the deployment configuration.
2
Configure Azure Key Vault access policies or Azure RBAC roles.
The identity is authorized to access secrets.
By default, the managed identity has no permissions, so you must explicitly grant it GET permission to read secrets.
3
Access the Key Vault from the application code within the container.
The application successfully retrieves the secret.
The code uses Azure SDKs (e.g., DefaultAzureCredential) to authenticate using the environment's managed identity and retrieve the secret.

Key Concept

Configuring access policies or RBAC roles to grant an ACI managed identity access to Azure Key Vault secrets.
Estimated Time:1m 0s
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic