Examkin

Question

Difficulty: MediumSecure App Configuration and Key Vault References

You are deploying a Node.js microservice to an Azure Kubernetes Service (AKS) cluster. The microservice uses a user-assigned managed identity named `mi-node-app` via workload identity.

The microservice must load configuration settings from an Azure App Configuration store named `appconfig-prod`. The store contains several configurations, including Key Vault references pointing to database credentials in an Azure Key Vault named `kv-prod`.

You need to configure the minimum required role assignments to allow the microservice to successfully fetch all configurations and resolve the Key Vault references.

Which two actions should you perform? Select two.

  1. Assign the App Configuration Data Reader role on `appconfig-prod` to the `mi-node-app` user-assigned managed identity.Answer
  2. Assign the Key Vault Secrets User role on `kv-prod` to the `mi-node-app` user-assigned managed identity.Answer
  3. C
    Assign the Key Vault Secrets User role on `kv-prod` to the system-assigned identity of the AKS cluster's node pool.
  4. D
    Assign the Key Vault Secrets User role on `kv-prod` to the system-assigned managed identity of the `appconfig-prod` store.
  5. E
    Assign the App Configuration Data Owner role on `appconfig-prod` to the `mi-node-app` user-assigned managed identity.

Answer

Assign the App Configuration Data Reader role on `appconfig-prod` to the `mi-node-app` user-assigned managed identity, and assign the Key Vault Secrets User role on `kv-prod` to the `mi-node-app` user-assigned managed identity.
The microservice's user-assigned managed identity (`mi-node-app`) needs direct read access to the App Configuration store to retrieve configuration key-values and Key Vault reference metadata. It also needs direct access to the Key Vault because Key Vault references are resolved on the client side by the application's SDK.

Step-by-Step Solution

1
Identify the identity used by the microservice.
The microservice authenticates using the workload identity associated with the `mi-node-app` user-assigned managed identity.
Permissions must be granted to the specific identity used by the workload running in the AKS cluster.
2
Assign the necessary role to read configuration metadata.
Grant the App Configuration Data Reader role on `appconfig-prod` to `mi-node-app`.
This allows the application SDK to fetch the keys and the Key Vault reference metadata from Azure App Configuration.
3
Assign the necessary role to resolve Key Vault secrets.
Grant the Key Vault Secrets User role on `kv-prod` to `mi-node-app`.
Key Vault references are resolved client-side by the application's client library, requiring direct read access to the secrets in Key Vault.

Key Concept

Key Vault references in Azure App Configuration are resolved client-side by the application, requiring the application's identity to have read permissions on both the App Configuration store and the target Key Vault.
Rate this question

Topics

Secure App Configuration and Key Vault References

More questions from this topic