An Azure App Configuration store needs to retrieve a database password stored in an Azure Key Vault named kv-app-prod at runtime. The Key Vault uses the Azure Role-Based Access Control (RBAC) permission model. The App Configuration store has a system-assigned managed identity enabled. Which of the following actions should you perform to configure the App Configuration store to reference the Key Vault secret? (Select TWO.)
- Assign the 'Key Vault Secrets User' role to the system-assigned managed identity of the App Configuration store at the Key Vault scope.Answer
- Create a Key Vault reference in Azure App Configuration by providing the secret URI 'https://kv-app-prod.vault.azure.net/secrets/DbPassword'.Answer
- CAdd a Key Vault access policy to kv-app-prod that grants Secret Get permission to the system-assigned managed identity of the App Configuration store.
- DCreate a key-value pair in Azure App Configuration with the value set to '@Microsoft.KeyVault(SecretUri=https://kv-app-prod.vault.azure.net/secrets/DbPassword)'.
Answer
Assign the 'Key Vault Secrets User' role to the system-assigned managed identity of the App Configuration store at the Key Vault scope, and create a Key Vault reference in Azure App Configuration by providing the secret URI.
To retrieve secrets from a Key Vault that uses Azure RBAC, the App Configuration store's managed identity must be assigned the 'Key Vault Secrets User' role. The App Configuration store references the secret using its direct URI.
Step-by-Step Solution
Key Concept
Azure Key Vault Integration with Azure App Configuration under Azure RBAC