Examkin

Question

Difficulty: HardSecure API Management Endpoints

You need to secure the connection between an Azure API Management (APIM) instance and a backend API hosted on Azure App Service. The backend API requires Azure Active Directory (Azure AD) authentication. You want to use a user-assigned managed identity named apim-backend-identity to authenticate the APIM instance against the backend API. Which of the following configuration steps should you perform? Select two.

  1. Associate the user-assigned managed identity named apim-backend-identity with the API Management instance.Answer
  2. In the inbound section of the API Management policy, add the authentication-managed-identity policy, specifying the backend API's resource identifier and the client ID of apim-backend-identity.Answer
  3. C
    In the inbound section of the API Management policy, add the authentication-managed-identity policy, specifying the resource identifier without providing a client ID.
  4. D
    In the outbound section of the API Management policy, add the authentication-managed-identity policy, specifying the backend API's resource identifier and the client ID of apim-backend-identity.
  5. E
    Create an Azure Key Vault access policy that grants the API Management system-assigned managed identity the Secret Get permission to fetch the backend application's client secret.

Answer

Associate the user-assigned managed identity named apim-backend-identity with the API Management instance, and add the authentication-managed-identity policy in the inbound section of the API Management policy, specifying the backend API's resource identifier and the client ID of apim-backend-identity.
To secure backend connections using a user-assigned managed identity, you must first associate the identity with the API Management instance. Next, you must configure the inbound policy section using the authentication-managed-identity policy. Since user-assigned managed identities are not the default, you must explicitly specify the client ID of the user-assigned identity within the policy configuration so that the correct token is obtained and attached to the request.

Step-by-Step Solution

1
Associate the user-assigned managed identity with the API Management resource.
The identity is linked to the APIM instance, allowing the gateway to request tokens on its behalf.
An identity must be associated with the Azure resource before it can be referenced in any configuration or policy.
2
Add the authentication-managed-identity policy to the inbound policy pipeline.
The gateway is configured to request an Azure AD token for the backend API and add it to the outgoing Authorization header.
Authentication policies must run during the inbound phase to modify the request before it is forwarded to the backend service.
3
Set the client-id attribute of the authentication-managed-identity policy to the client ID of the user-assigned managed identity.
The gateway uses the specified user-assigned managed identity rather than the system-assigned managed identity.
If the client-id attribute is omitted, the gateway defaults to using the system-assigned managed identity, which would cause authentication to fail.

Key Concept

Securing backend services using Managed Identity in Azure API Management
Rate this question

Topics

Secure API Management Endpoints

More questions from this topic